MSIL/Injector.WGN removal tips

The MSIL/Injector.WGN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Injector.WGN virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/Injector.WGN?


File Info:
name: FB3B4C0DCC593D81760A.mlw
path: /opt/CAPEv2/storage/binaries/1bc02af5741631e069b266ef0d4d5dd06f522abfecd5df3ffeaae1fc90f42f92
crc32: E068CDF9
md5: fb3b4c0dcc593d81760a0a4ca90dced6
sha1: 451636ec53f8cd2a93358648107e2d86ff7c9744
sha256: 1bc02af5741631e069b266ef0d4d5dd06f522abfecd5df3ffeaae1fc90f42f92
sha512: 74102be3d6753de9684932b9bf0fef3097fd11f8ba63aef8add91d0d301d4329142f49c626bca52a7175029a39d8d1e461919a4779beb0751310196198e058f5
ssdeep: 6144:36P+xfBJ6KaWEG3G/1Qm66kMzMwNRxNfNUqesRceUHVQvOcFGBv/MMMmcHdYCxMP:qPif/y1Q5lMIwNRxyHHVaOc8kMW1U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T192C4B0F8ABF06E00E2592D72F4D7512C23D37906B972E72F7A5A71463C426E308D5B86
sha3_384: 101a6a37645a86ef43e7477bc741801999f5427161eccc1c7f2da0010be02660c26916d9212ec110cf45dcb86cf2d767
ep_bytes: ff250020400000000000000000000000
timestamp: 2050-05-18 17:14:03

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: COM Surrogate
FileVersion: 1.0.0.0
InternalName: dllhost.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: dllhost.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Injector.WGN also known as:

Bkav	W32.Common.E72923D0
Lionic	Trojan.Win32.Bladabindi.4!c
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
FireEye	Generic.mg.fb3b4c0dcc593d81
Malwarebytes	Trojan.Downloader
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	Trojan:MSIL/Injector.06f1f169
K7GW	Trojan ( 005a6a901 )
K7AntiVirus	Trojan ( 005a6a901 )
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Agent.FTT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Injector.WGN
Cynet	Malicious (score: 100)
BitDefender	Gen:Heur.MSIL.Bladabindi.1
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Inject.Wmhl
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
F-Secure	Trojan.TR/Injector.fzcuy
VIPRE	Gen:Heur.MSIL.Bladabindi.1
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-R
SentinelOne	Static AI – Malicious PE
GData	Gen:Heur.MSIL.Bladabindi.1
Avira	TR/Injector.fzcuy
Antiy-AVL	Trojan/MSIL.Injector
Arcabit	Trojan.MSIL.Bladabindi.1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5442233
McAfee	Artemis!FB3B4C0DCC59
MAX	malware (ai score=83)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CGH23
Rising	Trojan.Injector!8.C4 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/WGN!tr
BitDefenderTheta	Gen:NN.ZemsilF.36318.Km0@ail9Ftj
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.dcc593
DeepInstinct	MALICIOUS

How to remove MSIL/Injector.WGN?

MSIL/Injector.WGN removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X