How to remove “Backdoor:MSIL/Orcus.A!bit”?

Malware Removal

The Backdoor:MSIL/Orcus.A!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Backdoor:MSIL/Orcus.A!bit virus can do?

  • The binary likely contains encrypted or compressed data.
  • Network activity detected but not expressed in API logs

How to determine Backdoor:MSIL/Orcus.A!bit?


File Info:

crc32: 8C31B3ED
md5: ccedce2c9563d44c90398d575c77e1bf
name: l.exe
sha1: e83bcda2993aa1aaeda06e47a862bd600e6223ab
sha256: 7ffa8a4939cf92caf8983afa85749d4fcb5eaa78769fe4f5dc7794a263ee5ed3
sha512: eb4985c06164cf68119fe1bc187a9b6d68acb559df53bc7d4697ef2b80f943d1d3e67e6e24474a911ebf4a51b3bc0e1214cd4d420065d70704ac7eb302c077a3
ssdeep: 24576:7Ka4MROxnFf3+zyrrcI0AilFEvxHPBWqoot:7OMidZrrcI0AilFEvxHPB
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright:
Assembly Version: 1.0.0.0
InternalName: Orcus.exe
FileVersion: 1.0.0.0
CompanyName:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription:
OriginalFilename: Orcus.exe

Backdoor:MSIL/Orcus.A!bit also known as:

MicroWorld-eScanGeneric.MSIL.PasswordStealerA.95E5CD5A
FireEyeGeneric.mg.ccedce2c9563d44c
CAT-QuickHealTrojan.MsilFC.S6051223
McAfeeBackDoor-FDJE!CCEDCE2C9563
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusTrojan ( 005011a81 )
BitDefenderGeneric.MSIL.PasswordStealerA.95E5CD5A
K7GWTrojan ( 005011a81 )
Cybereasonmalicious.c9563d
Invinceaheuristic
BitDefenderThetaGen:NN.ZemsilF.34104.4m0@aC5C6z
CyrenW32/MSIL_Injector.KK.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Packed.Razy-6847895-0
GDataMSIL.Backdoor.Orcus.A
KasperskyHEUR:Trojan-Spy.MSIL.Generic
AlibabaMalware:Win32/Dorpal.ali1000029
TencentMalware.Win32.Gencirc.10b969c5
Ad-AwareGeneric.MSIL.PasswordStealerA.95E5CD5A
SophosTroj/Orcusrot-A
ComodoMalware@#2ow6doh61qxkv
F-SecureHeuristic.HEUR/AGEN.1013795
DrWebTrojan.DownLoader24.57377
TrendMicroBKDR_ORCUSRAT.SM
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
Trapminemalicious.high.ml.score
EmsisoftBackdoor.Orcus (A)
SentinelOneDFI – Malicious PE
F-ProtW32/MSIL_Injector.KK.gen!Eldorado
JiangminTrojanSpy.MSIL.sam
eGambitUnsafe.AI_Score_99%
AviraHEUR/AGEN.1013795
MAXmalware (ai score=100)
Endgamemalicious (high confidence)
ArcabitGeneric.MSIL.PasswordStealerA.95E5CD5A
SUPERAntiSpywareTrojan.Agent/Gen-Injector
ZoneAlarmHEUR:Trojan-Spy.MSIL.Generic
MicrosoftBackdoor:MSIL/Orcus.A!bit
AhnLab-V3Win-Trojan/OrcusRAT.Exp
VBA32Trojan.Downloader
ALYacGeneric.MSIL.PasswordStealerA.95E5CD5A
MalwarebytesBackdoor.Orcus
PandaTrj/CI.A
ESET-NOD32a variant of MSIL/Orcusrat.D
TrendMicro-HouseCallBKDR_ORCUSRAT.SM
RisingBackdoor.Orcus!1.BABC (CLOUD)
YandexTrojan.Orcusrat!
IkarusTrojan.MSIL.Agent
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/Generic.AP.F529E!tr
AVGWin32:CrypterX-gen [Trj]
AvastWin32:CrypterX-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Trojan.Generic

How to remove Backdoor:MSIL/Orcus.A!bit?

Backdoor:MSIL/Orcus.A!bit removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment