MSIL/Agent.DAK removal guide

The MSIL/Agent.DAK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.DAK virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Anomalous binary characteristics

How to determine MSIL/Agent.DAK?


File Info:
crc32: FAB96638
md5: 54ec39f2ea8e986124525670afb2cffd
name: 54EC39F2EA8E986124525670AFB2CFFD.mlw
sha1: 39aa2ca09d35513e323fd77c95bc9836176c990d
sha256: 1ff51be88103ec4492613582af80f682292f70f7270ec457c7ca14a89fe324bb
sha512: 04f610a14a5c6dce64e2649826b34743677e66f088d2bdb411760de95bd3d20a008947b7a71c9b8a7fbd7980ea2ee0292179cf862a158d2e9098f01269a6b414
ssdeep: 384:A7AHEiirE5m8f+ywg6WQ4BfmYOWbVgaWwQS9cWbOeW:AnA5m8HNzfbiaWdqc
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: svchost.exe
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
FileDescription: Host Process for Windows Services
OriginalFilename: Microsoft Corporation.exe
Translation: 0x0000 0x04b0

MSIL/Agent.DAK also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSIL.Krypt.2
Qihoo-360	HEUR/QVM03.0.70FF.Malware.Gen
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
BitDefender	Gen:Heur.MSIL.Krypt.2
K7GW	Trojan ( 700000121 )
Cybereason	malicious.2ea8e9
Cyren	W32/MSIL_Kryptik.AXU.gen!Eldorado
APEX	Malicious
Avast	MSIL:GenMalicious-BOG [Trj]
Kaspersky	HEUR:Trojan.MSIL.RRAT.gen
Ad-Aware	Gen:Heur.MSIL.Krypt.2
Emsisoft	Gen:Heur.MSIL.Krypt.2 (B)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	BackDoor.SpyBotNET.20
FireEye	Generic.mg.54ec39f2ea8e9861
Sophos	ML/PE-A
Avira	TR/ATRAPS.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.MSIL.Krypt.2
ZoneAlarm	HEUR:Trojan.MSIL.RRAT.gen
GData	Gen:Heur.MSIL.Krypt.2
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.RL_Generic.C3517676
BitDefenderTheta	Gen:NN.ZemsilF.34574.bm0@aGCU2ml
ALYac	Gen:Heur.MSIL.Krypt.2
MAX	malware (ai score=85)
Malwarebytes	Trojan.FakeMS
ESET-NOD32	a variant of MSIL/Agent.DAK
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Agent.ATK!tr
AVG	MSIL:GenMalicious-BOG [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Agent.DAK?

MSIL/Agent.DAK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X