About “MSIL/Agent.VOK” infection

The MSIL/Agent.VOK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.VOK virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/Agent.VOK?


File Info:
name: FA259965ACDB37DD639D.mlw
path: /opt/CAPEv2/storage/binaries/97c834e0d702f385f16dc29acae830458b672bbad96a0add00c1df364b60aacb
crc32: 87B49567
md5: fa259965acdb37dd639d77e827a17fdd
sha1: 4a4ffa6c32969ea21a9c8700e5005da6589e2cb3
sha256: 97c834e0d702f385f16dc29acae830458b672bbad96a0add00c1df364b60aacb
sha512: 058d24db4ca84ad9da8fbbbe81f21043b5ceee6ff755c848510ab9877cb4c4185f9f67f64f49c6838a9f5a4a51b9841850950afe7d288d968e4b67014313eb2f
ssdeep: 24576:9ipMDaZFUj0KICBBBYvJHjdk6kMRbXerSIlIkYYDx:0aaZxCuBHPfbb/YDx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T141456A827FC5991BC91F4F3699624654A7F8E905A747F74B7C8033EC2C863AC9C422E6
sha3_384: 0b09351ba3d3deb5578dd3cef14bdfbe0632da3c326c9d99612da404297c69dab8e458144de7101e15116b844a3a1197
ep_bytes: ff250020400000000000000000000000
timestamp: 2024-02-15 16:23:03

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: PenterWare.exe
LegalCopyright:  
OriginalFilename: PenterWare.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/Agent.VOK also known as:

Bkav	W32.AIDetectMalware.CS
MicroWorld-eScan	Gen:Heur.Ransom.REntS.Gen.1
ClamAV	Win.Malware.Msilmamut-9974990-0
FireEye	Generic.mg.fa259965acdb37dd
Skyhigh	BehavesLike.Win32.Trojan.th
Cylance	unsafe
Sangfor	Ransom.Msil.Agent.Vcs6
K7AntiVirus	Trojan ( 005956f01 )
Alibaba	Ransom:MSIL/PenTera.a0cfc528
K7GW	Trojan ( 005956f01 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Ransom.REntS.Gen.1
BitDefenderTheta	Gen:NN.ZemsilF.36744.ln0@aC9shGn
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.VOK
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Gen:Heur.Ransom.REntS.Gen.1
Avast	Win32:MalwareX-gen [Trj]
Tencent	Msil.Trojan.Agent.Hkjl
Emsisoft	Gen:Heur.Ransom.REntS.Gen.1 (B)
F-Secure	Heuristic.HEUR/AGEN.1305750
VIPRE	Gen:Heur.Ransom.REntS.Gen.1
TrendMicro	Ransom_PenTera.R03BC0DBK24
Trapmine	malicious.moderate.ml.score
SentinelOne	Static AI – Malicious PE
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1305750
MAX	malware (ai score=83)
Kingsoft	malware.kb.c.1000
Microsoft	Ransom:MSIL/PenTera.F!MSR
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
GData	Gen:Heur.Ransom.REntS.Gen.1
Varist	W32/A-8f5775ec!Eldorado
AhnLab-V3	Trojan/Win.Generic.R491781
McAfee	Artemis!FA259965ACDB
Malwarebytes	Trojan.Crypt.MSIL
TrendMicro-HouseCall	Ransom_PenTera.R03BC0DBK24
Rising	Trojan.Agent!8.B1E (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.VOK!tr.ransom
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove MSIL/Agent.VOK?

MSIL/Agent.VOK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X