Backdoor:MSIL/PasGen.YA!MTB removal tips

The Backdoor:MSIL/PasGen.YA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:MSIL/PasGen.YA!MTB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Attempts to remove evidence of file being downloaded from the Internet
Detects Avast Antivirus through the presence of a library
A process was set to shut the system down when terminated
Installs itself for autorun at Windows startup
Exhibits behavior characteristic of Nanocore RAT
Creates a copy of itself
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

adminsaintsrows.ddns.net

How to determine Backdoor:MSIL/PasGen.YA!MTB?


File Info:
crc32: 5E07ABF4
md5: 5664066d522b79fbfab76c96c0b4f0f3
name: 5664066D522B79FBFAB76C96C0B4F0F3.mlw
sha1: 27b8afce3f5302ad11c93c32ca1a1d7ed028cb4c
sha256: 0b2515646bba2d4f54436f912e4386cd5d6b3a0c84957840254058ab32f6fed0
sha512: b72de89376e51bbc42284309500f6289632aff492654342f1295de63053304e62bd49ecae2698dbb3ce8c72a59a1c2eb1e063a9148cd75cb2645aa5a78c29915
ssdeep: 12288:W+zgx/+4zXwWossZo4u11UhorI0wsIb/sxSNbDxGFFbF:1gx/+4zyQ11drI0yb/TZD8FbF
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 1.0.0.0
InternalName: topher + nano.exe
FileVersion: 1.0.0.0
ProductVersion: 1.0.0.0
FileDescription:  
OriginalFilename: topher + nano.exe

Backdoor:MSIL/PasGen.YA!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.41036
FireEye	Generic.mg.5664066d522b79fb
McAfee	GenericRXAG-NE!5664066D522B
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 004f47761 )
BitDefender	Trojan.GenericKDZ.41036
K7GW	Trojan ( 004f47761 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/MSIL_Agent.BOZ.gen!Eldorado
Symantec	Trojan.Nancrat
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.Win32.Generic
Alibaba	Backdoor:MSIL/PasGen.6bb59071
Ad-Aware	Trojan.GenericKDZ.41036
Emsisoft	Trojan.GenericKDZ.41036 (B)
Comodo	TrojWare.MSIL.Fynloski.GSZ@7edpi4
F-Secure	Heuristic.HEUR/AGEN.1129530
DrWeb	Trojan.DownLoader19.34409
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
MaxSecure	Trojan.Malware.300983.susgen
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.Krypt
Avira	HEUR/AGEN.1129530
MAX	malware (ai score=89)
Microsoft	Backdoor:MSIL/PasGen.YA!MTB
Arcabit	Trojan.Generic.DA04C
ZoneAlarm	HEUR:Backdoor.Win32.Generic
GData	Trojan.GenericKDZ.41036
AhnLab-V3	Malware/Win32.RL_Generic.C3468866
ALYac	Trojan.GenericKDZ.41036
Malwarebytes	Backdoor.Agent.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.GSZ
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Injector.REB!tr
BitDefenderTheta	Gen:NN.ZemsilF.34804.Gm0@aaaFzji
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	HEUR/QVM03.0.09F7.Malware.Gen

How to remove Backdoor:MSIL/PasGen.YA!MTB?

Backdoor:MSIL/PasGen.YA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor:MSIL/PasGen.YA!MTB removal tips