Categories: Malware

MSIL/Agent.TBG removal tips

The MSIL/Agent.TBG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Agent.TBG virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Possible date expiration check, exits too soon after checking local time
Enumerates the modules from a process (may be used to locate base addresses in process injection)
CAPE extracted potentially suspicious content
Authenticode signature is invalid
CAPE detected the RedLine malware family
Anomalous binary characteristics

How to determine MSIL/Agent.TBG?


File Info:
name: DB567893D7ED6EA41F23.mlwpath: /opt/CAPEv2/storage/binaries/1aeba7ca78d9bbe78b381af8176247444255082a1a9fb52350d76f92042372c6crc32: 05465654md5: db567893d7ed6ea41f230567c25cbcabsha1: 83f9f4dd9744d3103c20d5654380c14ab38ebce2sha256: 1aeba7ca78d9bbe78b381af8176247444255082a1a9fb52350d76f92042372c6sha512: 57eed8c6575ec09233ebd6c314c1a92181b0afccefa24dd1906fe17811f797c2431f03c39897193504f0b4a78a17165388a58ca94fe0f84ab52b642da2cc9c57ssdeep: 12288:yh1Lk70TnvjctE3Kg8CDuHPup374V1eHrTY7U526zEw4FV5TCcDy:Gk70Trc+PvD7x7PL+6zDGVPytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14115E1201B90C077C26278F8C1E1DF99A5B85C701B668A83F6BB3D798734397EE5518Esha3_384: bfdb67decd934589318a304a6b459e5743c0a00e1a370711c909fae99a60d9a0887b0c532320aa44c04cfcd85f5f1effep_bytes: e8e15c0000e9a4feffff8bff558bec83timestamp: 2012-07-13 22:47:16
Version Info:
Translation: 0x0000 0x04b0Comments: WindowsCompanyName: FileDescription: WindowsFileVersion: 1.0.0.0InternalName: Windows.exeLegalCopyright: Windows Copyright ©  2015LegalTrademarks: OriginalFilename: Windows.exeProductName: WindowsProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

MSIL/Agent.TBG also known as:

Lionic	Trojan.Win32.Blocker.j!c
MicroWorld-eScan	Trojan.GenericKD.31474472
ALYac	Trojan.GenericKD.31474472
Cylance	Unsafe
Sangfor	Backdoor.Win32.Bladabindi.ml
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Starter.ali2000005
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_70% (W)
Cyren	W32/Agent.CIW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.TBG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Ransom.Win32.Blocker.llsj
BitDefender	Trojan.GenericKD.31474472
NANO-Antivirus	Trojan.Win32.Blocker.flquka
Tencent	Win32.Trojan.Blocker.Wsju
Ad-Aware	Trojan.GenericKD.31474472
Comodo	Malware@#f8enxls7rq9t
DrWeb	BackDoor.Bifrost.29284
Zillya	Trojan.Blocker.Win32.41614
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
FireEye	Generic.mg.db567893d7ed6ea4
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
GData	Trojan.GenericKD.31474472
Avira	TR/Agent.horpi
MAX	malware (ai score=81)
Microsoft	Backdoor:Win32/Bladabindi!ml
AhnLab-V3	Malware/Win32.Generic.C2954871
McAfee	Artemis!DB567893D7ED
VBA32	TrojanRansom.Blocker
Panda	Trj/CI.A
Rising	Ransom.Blocker!8.12A (CLOUD)
Yandex	Trojan.Blocker!n4wW7pvpdXk
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.74036593.susgen
Fortinet	W32/Blocker.LLSJ!tr
BitDefenderTheta	Gen:NN.ZexaF.34606.1q0@aWT5Cgg
AVG	Win32:Malware-gen
Cybereason	malicious.3d7ed6
Avast	Win32:Malware-gen