Backdoor.MSIL.Xtreme removal instruction

The Backdoor.MSIL.Xtreme is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.MSIL.Xtreme virus can do?

CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid

How to determine Backdoor.MSIL.Xtreme?


File Info:
name: C6A1C6DC61713F4E870A.mlw
path: /opt/CAPEv2/storage/binaries/38383102bcf514c9bab8ac80bdc4568fc12cad2729fdbaeff7628d01d5e59ec1
crc32: D0CCC4C7
md5: c6a1c6dc61713f4e870a46a3af5a3402
sha1: 2a74674cdbb300551a2ded8bb66dc143f07ca0c8
sha256: 38383102bcf514c9bab8ac80bdc4568fc12cad2729fdbaeff7628d01d5e59ec1
sha512: b531d41dd723fb3f0f313e85a1cb9985fd05906e69a727824d97c543e5b88432fe62a5c7b1c21db76b15d6b638d67f970884824ebe0639d44c22f9b4ce654640
ssdeep: 3072:+dP3xygroNzU6wwTb0tYjJm619LJDWWH2RCeVhfDf2Z:eBTcJ/WwIhT2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A694DD2CA6D78389FC779E7E8BD0B461852EB1B2FAC7639B0771024A4A11650CDD1D3B
sha3_384: 6cd61ca2db865717827e2d1356a552bee963beb2f4e930e20b3e2060c1a3e4d4e22c646b1b2b53fd611dad40fb48466e
ep_bytes: ff250020400000000000000000000000
timestamp: 2013-12-30 00:51:45

Version Info:
Translation: 0x0000 0x04b0
CompanyName: aHlh0M4Q6PFd5
FileDescription: aM2UVWCYPnB
FileVersion: 14.19.24.97
InternalName: Hotspot Shield.lnk.exe
LegalCopyright: Copyright © 2012
LegalTrademarks: aZaEKJjnqhWZA3ei9dk3
OriginalFilename: Hotspot Shield.lnk.exe
ProductName: a7ILDvTzSY4coomta
ProductVersion: 14.19.24.97
Assembly Version: 9.14.19.87

Backdoor.MSIL.Xtreme also known as:

MicroWorld-eScan	IL:Trojan.MSILZilla.24897
ClamAV	Win.Packed.Fecn-7077459-0
FireEye	Generic.mg.c6a1c6dc61713f4e
CAT-QuickHeal	TrjnDwnldrMSIL.Ranos.A4
McAfee	GenericRXJS-SS!C6A1C6DC6171
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
Cybereason	malicious.cdbb30
BitDefenderTheta	Gen:NN.ZemsilF.36738.Am0@aOvukxc
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Troj.EJ.gen!Eldorado
Symantec	Backdoor.Ratenjay
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Injector.CJO
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.Xtreme.gen
BitDefender	IL:Trojan.MSILZilla.24897
NANO-Antivirus	Trojan.Win32.Disfa.cwbhis
Avast	MSIL:GenMalicious-E [Trj]
Emsisoft	IL:Trojan.MSILZilla.24897 (B)
F-Secure	Heuristic.HEUR/AGEN.1309953
VIPRE	IL:Trojan.MSILZilla.24897
McAfee-GW-Edition	GenericRXJS-SS!C6A1C6DC6171
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
GData	IL:Trojan.MSILZilla.24897
Avira	HEUR/AGEN.1309953
Antiy-AVL	GrayWare/MSIL.Injector.cjo
Xcitium	TrojWare.MSIL.Injector.CK@57m9xp
Arcabit	IL:Trojan.MSILZilla.D6141
ZoneAlarm	HEUR:Backdoor.MSIL.Xtreme.gen
Microsoft	TrojanDownloader:MSIL/Ranos.A
Google	Detected
ALYac	IL:Trojan.MSILZilla.24897
MAX	malware (ai score=88)
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
Panda	Generic Malware
Rising	Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:RwqCApvvRw4av0lEyqrLKw)
Ikarus	Trojan.MSIL.Injector
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Injector.CKC!tr
AVG	MSIL:GenMalicious-E [Trj]
DeepInstinct	MALICIOUS

How to remove Backdoor.MSIL.Xtreme?

Backdoor.MSIL.Xtreme removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X