Malware

Generic.MSIL.PasswordStealerA.D211CA80 removal instruction

Malware Removal

The Generic.MSIL.PasswordStealerA.D211CA80 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic.MSIL.PasswordStealerA.D211CA80 virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • A process was set to shut the system down when terminated
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a copy of itself

How to determine Generic.MSIL.PasswordStealerA.D211CA80?


File Info:

crc32: 025DB0C6
md5: 5c478907d58b3f45407f468c569d30a4
name: xenos_patcher.exe
sha1: 33d603cf4de89dae0c16d5d0929d8830c26847dc
sha256: ec0bab69eaad7500842a735b69b004a4b6f8e6fb2c262a97acc623b8033e7c45
sha512: 6f1adddbb20c92f3e3e88fc14609a4c450f7d9a3a51ee3a44df8fec4e837d73c5e54e24e52c55b4a590ebd073cdc51471f9c67d4361d26c402324d219c7b11db
ssdeep: 24576:msS04YNEMuExDiU6E5R9s8xY/2l/d+uIbt+rb:mE4auS+UjfU2T+uIbt+r
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright:
Assembly Version: 1.0.0.0
InternalName: Orcus.exe
FileVersion: 1.0.0.0
CompanyName:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription:
OriginalFilename: Orcus.exe

Generic.MSIL.PasswordStealerA.D211CA80 also known as:

MicroWorld-eScanGeneric.MSIL.PasswordStealerA.D211CA80
FireEyeGeneric.mg.5c478907d58b3f45
CAT-QuickHealTrojan.GenericFC.S6055878
McAfeeGenericRXAB-TF!5C478907D58B
CylanceUnsafe
ZillyaTrojan.Agent.Win32.881331
SangforMalware
K7AntiVirusTrojan ( 004dcf4d1 )
BitDefenderGeneric.MSIL.PasswordStealerA.D211CA80
K7GWTrojan ( 004dcf4d1 )
Cybereasonmalicious.7d58b3
BitDefenderThetaGen:NN.ZemsilF.34084.0m0@aSCygvi
CyrenW32/Trojan.SW.gen!Eldorado
APEXMalicious
AvastWin32:RATX-gen [Trj]
ClamAVWin.Packed.Razy-6847895-0
GDataMSIL.Backdoor.Orcus.A
KasperskyHEUR:Trojan.Win32.Generic
NANO-AntivirusTrojan.Win32.Dwn.edhbpv
AegisLabTrojan.Win32.Generic.4!c
RisingBackdoor.Pontoeb!1.6637 (CLOUD)
Endgamemalicious (high confidence)
EmsisoftBackdoor.Orcus (A)
ComodoMalware@#1bwgoq9q625r7
F-SecureHeuristic.HEUR/AGEN.1016231
DrWebTrojan.DownLoader21.63449
VIPRETrojan.Win32.Generic!BT
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Generic.cc
Trapminemalicious.high.ml.score
SophosMal/Generic-S
IkarusTrojan.MSIL.Agent
F-ProtW32/Trojan.SW.gen!Eldorado
JiangminTrojan.Generic.acbpm
WebrootW32.Malware.Gen
AviraHEUR/AGEN.1016231
MAXmalware (ai score=100)
ArcabitGeneric.MSIL.PasswordStealerA.D211CA80
SUPERAntiSpywareTrojan.Agent/Gen-Injector
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftTrojan:Win32/Skeeyah.A!rfn
AhnLab-V3Trojan/Win32.Orcusrot.C1515795
Acronissuspicious
VBA32Trojan.Downloader
ALYacGeneric.MSIL.PasswordStealerA.D211CA80
Ad-AwareGeneric.MSIL.PasswordStealerA.D211CA80
MalwarebytesBackdoor.Orcus
PandaTrj/GdSda.A
ESET-NOD32a variant of MSIL/Orcusrat.C
TencentWin32.Trojan.Generic.Swux
YandexTrojan.Agent!Hx8qYD7sXzk
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_100%
FortinetMSIL/SpyPSW.AVQ!tr
AVGWin32:RATX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360Win32/Trojan.f87

How to remove Generic.MSIL.PasswordStealerA.D211CA80?

Generic.MSIL.PasswordStealerA.D211CA80 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment