How to remove “HackTool:MSIL/SmbAgent!atmn”?

The HackTool:MSIL/SmbAgent!atmn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:MSIL/SmbAgent!atmn virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine HackTool:MSIL/SmbAgent!atmn?


File Info:
name: 47916DFD2F36DDC9CC26.mlw
path: /opt/CAPEv2/storage/binaries/14cbad8af2629f6a644feb0370783e6355e733a3b72c4781fe822a8e216f9750
crc32: BB21665D
md5: 47916dfd2f36ddc9cc26fa1e8541c98d
sha1: 5e02dd2fbc7f027d6ae2a4f9bb712bf1adf8e46a
sha256: 14cbad8af2629f6a644feb0370783e6355e733a3b72c4781fe822a8e216f9750
sha512: 099f6f8360061feaaa6b6845089e43104ea15f5832ff47a269336ed0a45f549635d3e5ca5efea8ed63cf9d4c73d294b2a12d88516c1abd5dd829c478305b05b2
ssdeep: 96:cH+lj9YDhx/cHyTqc8AUbCC+Arz88SLTOBOJobgw9YElK:cHQYb/ZuF2A88StXkK
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T19ED1C789BBD40E53E83B0B785D73A32A5774F9429E535BAF086012343E51B902F61BF1
sha3_384: f0068ed329638bf3154376f5a00e8d0a9c4ff2ac5b1e2a9caecfcbc2f4c91f6eabb9507ec3f6412a2b5a88891c608a07
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-01-29 22:49:34

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: 2ufkfonp.dll
LegalCopyright:  
OriginalFilename: 2ufkfonp.dll
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

HackTool:MSIL/SmbAgent!atmn also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Hacktool.MSIL.SMBScan.3!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen7.34567
MicroWorld-eScan	Generic.Malware.WX.E7529F76
CAT-QuickHeal	Trojan.GenericFC.S2479216
Skyhigh	BehavesLike.Win32.Agent.xt
McAfee	Agent-SMB.b!47916DFD2F36
Cylance	unsafe
Zillya	Tool.Agent.Win32.55562
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
K7GW	Trojan ( 005962b21 )
K7AntiVirus	Trojan ( 005962b21 )
Arcabit	Generic.Malware.WX.E7529F76
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/HackTool.Agent.BW potentially unsafe
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Smbagent-9769162-0
Kaspersky	HEUR:HackTool.MSIL.SMBScan.gen
BitDefender	Generic.Malware.WX.E7529F76
NANO-Antivirus	Trojan.Win32.Ric.ezglxv
Avast	Win32:HacktoolX-gen [Trj]
Tencent	HackTool.MSIL.SmbScan.ha
Emsisoft	Generic.Malware.WX.E7529F76 (B)
VIPRE	Generic.Malware.WX.E7529F76
Sophos	Generic ML PUA (PUA)
Ikarus	HackTool.MSIL.SMBScan
Varist	W32/Hacktool.J.gen!Eldorado
Antiy-AVL	HackTool/Win32.Agent.a
Kingsoft	malware.kb.c.999
Xcitium	TrojWare.MSIL.HackTool.Agent.ASD@8sg90t
Microsoft	HackTool:MSIL/SmbAgent!atmn
ZoneAlarm	HEUR:HackTool.MSIL.SMBScan.gen
GData	MSIL.Riskware.SMBScanner.A
Google	Detected
AhnLab-V3	Unwanted/Win32.HackTool.R261573
Malwarebytes	Trojan.Crypt
Panda	Trj/GdSda.A
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/HackTool
AVG	Win32:HacktoolX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove HackTool:MSIL/SmbAgent!atmn?

HackTool:MSIL/SmbAgent!atmn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X