Downloader.MSIL.DownloadSponsor removal guide

The Downloader.MSIL.DownloadSponsor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Downloader.MSIL.DownloadSponsor virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A named pipe was used for inter-process communication
• Starts servers listening on 127.0.0.1:0
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• A possible heap spray exploit has been detected
• Attempts to modify proxy settings
• Harvests cookies for information gathering
• Anomalous binary characteristics

How to determine Downloader.MSIL.DownloadSponsor?

File Info:
name: 8245D9D34F455126D774.mlw
path: /opt/CAPEv2/storage/binaries/32e37e4878c46291b652bc1f236234e75ce2b42f76b9ac2bac66bac54b7f9cf4
crc32: A19403BE
md5: 8245d9d34f455126d774634ac170928c
sha1: f7a28f7e075289b122e0b92cf3400b9fe9b9bef4
sha256: 32e37e4878c46291b652bc1f236234e75ce2b42f76b9ac2bac66bac54b7f9cf4
sha512: 461c155642b8bb07f32fe9f10984fa40f9f1857f8978e2b12da573c054fb6e70ee2a141f2f4909a6e03b105d990c0219e7ce9215c0463039a1f31ff08832dfa3
ssdeep: 24576:Vtb20pkaCqT5TBWgNjVYg0VMjzKJ9TtrkI8JOR5dxnxFzQJ9TtFJiUT7dU4Ht9d+:GVg5tjVYgUf5XVdxU5O6vdx+5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T120959D2127EC9754D2BE477665B056005BB6BC228666F64E3FEC24FD3F313908A1A723
sha3_384: e7b4ba315d8d502b589e39777d0435089dd3adf0733cb1fbf400535a7702b23bac477e53497dd342104c80027bf593b6
ep_bytes: e86ace0000e97ffeffffcccc57568b74
timestamp: 2017-10-12 09:01:26

Version Info:
FileVersion: 2.8.3.5
Comments: CHIP Secured Installer
FileDescription: CHIP Secured Installer
ProductVersion: 2.8.3.5
LegalCopyright: Copyright © 2017 Chip Digital GmbH
CompanyName: CHIP Digital GmbH
InternalName: CHIP Secured Installer
ProductName: CHIP Secured Installer
OriginalFilename: CHIP Secured Installer
Translation: 0x0407 0x04b0

Downloader.MSIL.DownloadSponsor also known as:

How to remove Downloader.MSIL.DownloadSponsor?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.