How to remove “Backdoor.MSIL.Agobot”?

The Backdoor.MSIL.Agobot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.MSIL.Agobot virus can do?

How to determine Backdoor.MSIL.Agobot?


File Info:
crc32: B375471D
md5: 372092e997ed84efb4d5cdeb61820a73
name: 372092E997ED84EFB4D5CDEB61820A73.mlw
sha1: 5ad5315d87c87dba13d0f041ce2f83abbac7468d
sha256: d4e00a94b16acd89b61cd46d1fcee4385b0639dcd7d85029f6a6067f7b7437bf
sha512: f81e9370fb2321dba13fa1969ba092425b5d32ad97b57da449f670c994ad5f098334ff94aa520f85b74957280ee96d6bc5cd0c9542b34573d930eaf5b99fc3a3
ssdeep: 1536:Gqz8rx/RmUJAD246dQ7mm1oJPFi6ELGtZNaLWklb0Gp8fvVbGSYIgD1z75LEoT+:G6xH7Z1oJvrNaZTIZ65LEpdxu6
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: Stratus.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: Stratus.exe

Backdoor.MSIL.Agobot also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.63014
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Bulz.363132
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.997ed8
Cyren	W32/MSIL_Agent.BJO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.DCX
APEX	Malicious
Avast	Win32:SpywareX-gen [Trj]
ClamAV	Win.Packed.Bulz-9846744-0
Kaspersky	HEUR:Backdoor.MSIL.Agobot.gen
BitDefender	Gen:Variant.Bulz.363132
MicroWorld-eScan	Gen:Variant.Bulz.363132
Ad-Aware	Gen:Variant.Bulz.363132
BitDefenderTheta	Gen:NN.ZemsilF.34670.im1@aywtJsg
McAfee-GW-Edition	GenericRXNW-BS!372092E997ED
FireEye	Generic.mg.372092e997ed84ef
Emsisoft	Gen:Variant.Bulz.363132 (B)
SentinelOne	Static AI – Malicious PE
Microsoft	PWS:MSIL/RedLine.GG!MTB
Arcabit	Trojan.Bulz.D58A7C
GData	Gen:Variant.Bulz.363132
AhnLab-V3	Trojan/Win32.RL_RedLine.C4304939
McAfee	GenericRXNW-BS!372092E997ED
MAX	malware (ai score=86)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.RedLineStealer
Panda	Trj/GdSda.A
Rising	Spyware.Agent!8.C6 (TFE:dGZlOg2TiKlnopgsWg)
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Stealer.DCX!tr
AVG	Win32:SpywareX-gen [Trj]
Qihoo-360	HEUR/QVM03.0.52A4.Malware.Gen

How to remove Backdoor.MSIL.Agobot?

Backdoor.MSIL.Agobot removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X