MSIL/Agent.ELN removal

The MSIL/Agent.ELN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.ELN virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine MSIL/Agent.ELN?


File Info:
name: 283DFDB9BE8C29C1C771.mlw
path: /opt/CAPEv2/storage/binaries/c6fcc296e39c2cb8de0c1d6e39d04603c750b0e3a20b11974b3dbdcabe591b21
crc32: 2512F916
md5: 283dfdb9be8c29c1c771abaf502336e4
sha1: a79d6fd7b377b13a9bceced0cc5eef4ef63ebd0c
sha256: c6fcc296e39c2cb8de0c1d6e39d04603c750b0e3a20b11974b3dbdcabe591b21
sha512: d98f5d7229c760dc05a2da92bfccd638b75206b19ffa50f63134e282bcfd0224c41b28b46aa76f8bc8d898d8e43c252206234b36c578b2b8a49bd18599e28a55
ssdeep: 1536:hxUkkn6oYY0ewKP8Ae+KP9InB9bi0JnxUkkn6oYY0ewsP8:hxUJVYYPwKfKPanB9iInxUJVYYPws
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C9D3074826D0C876C66D27B0C4338E944A713C71DEA5FB2E4B98F12E3972393D956B1E
sha3_384: bad14065d0a3d2294d497f3e2a0eea31a5414044f793aefd0707c4da7e2df746c5cace0f396e317c617a1c49db03567f
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-05-14 15:22:03

Version Info:
Translation: 0x0000 0x04b0
FileDescription: Processus hôte pour les services Windows
FileVersion: 2.1.7600.1
InternalName: svehost.exe
LegalCopyright: © Microsoft Corporation Tous droits réservés.
OriginalFilename: svehost.exe
ProductName: Système d'exploitation Microsoft® Windows®
ProductVersion: 2.1.7600.1
Assembly Version: 2.1.7600.1

MSIL/Agent.ELN also known as:

Lionic	Trojan.Win32.Barys.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.32543
FireEye	Gen:Variant.Barys.32543
McAfee	Artemis!283DFDB9BE8C
Cylance	unsafe
VIPRE	Gen:Variant.Barys.32543
Sangfor	Trojan.Win32.Agent.Vb31
K7AntiVirus	Trojan ( 005a72371 )
Alibaba	Trojan:MSIL/MalwareX.43cd7d9f
K7GW	Trojan ( 005a72371 )
Cybereason	malicious.7b377b
BitDefenderTheta	Gen:NN.ZemsilF.36350.iq0@aiJZPni
ESET-NOD32	a variant of MSIL/Agent.ELN
APEX	Malicious
Cynet	Malicious (score: 99)
BitDefender	Gen:Variant.Barys.32543
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Trojan.Agent.Azlw
Emsisoft	Gen:Variant.Barys.32543 (B)
F-Secure	Trojan.TR/Agent.qtjai
McAfee-GW-Edition	Artemis
Trapmine	malicious.high.ml.score
GData	Gen:Variant.Barys.32543
Avira	TR/Agent.qtjai
Antiy-AVL	Trojan/Win32.SGeneric
Arcabit	Trojan.Barys.D7F1F
ALYac	Gen:Variant.Barys.32543
MAX	malware (ai score=87)
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R002H09EE23
MaxSecure	Trojan.Malware.208308460.susgen
Fortinet	Malicious_Behavior.SB
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (W)

How to remove MSIL/Agent.ELN?

MSIL/Agent.ELN removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X