MSIL/Agent.THK removal tips

The MSIL/Agent.THK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.THK virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with Confuser
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine MSIL/Agent.THK?


File Info:
name: 2D25B972AFEFCF755F6B.mlw
path: /opt/CAPEv2/storage/binaries/f9ab8e7fe0b9623b555f8e4517657a8214889bbe16cb147185347bf84b630e4b
crc32: 0CC72E4C
md5: 2d25b972afefcf755f6b7d40b24d0a92
sha1: f1f2d97742aa7d3d1c1d88a019136572ae9139c8
sha256: f9ab8e7fe0b9623b555f8e4517657a8214889bbe16cb147185347bf84b630e4b
sha512: 1a7b159074086d2bb80b5ca529d2e15efaae40d9e4dee128eb81788edca54702f94818243c5cc85e657b8486faf088b9fb5a8b446b58f85594aeecb7d958a244
ssdeep: 6144:TN0KJM8wfYwSnsXFC0yxv470md6CfSd9SGg/sF/HyQhLOk9pw7WfNi89GISJ3X:u98wfn8s1ewjkCfTd/sR9rJiaGv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14D74230173DF9331CA24833C7B7A568A7A86E7584986D2871B3482FF7A0B76F06549D3
sha3_384: 7ec244130299d25ebcb0727bc88d78b6a09311290333c965538dd6f848efaa2ae27a28cc97d6c4f0ce997497fb118f18
ep_bytes: ff250020400000000000000000000000
timestamp: 2019-07-10 21:37:50

Version Info:
Translation: 0x0000 0x04b0
Comments: Windows File Management Optimizer
CompanyName: Microsoft Corporation
FileDescription: Windows Explorer
FileVersion: 1.0.0.0
InternalName: Windows Explorer.exe
LegalCopyright: 8F89C700040F900C
LegalTrademarks: 
OriginalFilename: Windows Explorer.exe
ProductName: Windows Explorer
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Agent.THK also known as:

Lionic	Trojan.Win32.Xploder.i!c
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop10.1110
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
FireEye	Generic.mg.2d25b972afefcf75
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXIJ-RP!2D25B972AFEF
Cylance	Unsafe
Zillya	Trojan.Redcap.Win32.5
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanPSW:Win32/Xploder.07606764
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.2afefc
BitDefenderTheta	Gen:NN.ZemsilF.34182.vm0@aacCD0i
Cyren	W32/MSIL_Kryptik.FKA.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	MSIL/Agent.THK
TrendMicro-HouseCall	TROJ_GEN.R002C0DL421
Paloalto	generic.ml
Kaspersky	Trojan-PSW.Win32.Xploder.u
BitDefender	Gen:Heur.MSIL.Bladabindi.1
NANO-Antivirus	Trojan.Win32.Xploder.ipxypi
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10cf8460
Ad-Aware	Gen:Heur.MSIL.Bladabindi.1
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DL421
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Heur.MSIL.Bladabindi.1
Jiangmin	Trojan.MSIL.mxtl
Avira	TR/Agent.etoyb
MAX	malware (ai score=85)
Antiy-AVL	Trojan/MSIL.Dnoper
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Arcabit	Trojan.MSIL.Bladabindi.1
ZoneAlarm	Trojan-PSW.Win32.Xploder.u
Microsoft	Trojan:Win32/Wacatac.B!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Agent.C4084289
VBA32	TScope.Trojan.MSIL
Malwarebytes	Backdoor.Bot
APEX	Malicious
Yandex	Trojan.PWS.Xploder!1X0q5EptakU
Ikarus	PUA.MSIL.Confuser
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	Riskware/Xploder
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Agent.THK?

MSIL/Agent.THK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X