MSIL/PSW.Agent.OSO removal instruction

The MSIL/PSW.Agent.OSO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/PSW.Agent.OSO virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine MSIL/PSW.Agent.OSO?


File Info:
name: 02EA880DF914281F7511.mlw
path: /opt/CAPEv2/storage/binaries/e0dc8a1567bd34485feee8987ddb3e6e6caa56359048e68f3366a6b3596d7789
crc32: 04616949
md5: 02ea880df914281f7511cfbb1b605fde
sha1: d3a9d526815cf6519ec5951c07bec39bd9ecc040
sha256: e0dc8a1567bd34485feee8987ddb3e6e6caa56359048e68f3366a6b3596d7789
sha512: 0d236946ce8b7f4bd67e6b4f86c386e26838dc1284c7201e9e6fee9b593d4d9caf5676c8f71662b08ac0be32589500832d6f8afe1c45869f24b6952f70644b51
ssdeep: 384:YUzuokwVwA07UbDE3cMJZLoRE8oEutn+q/NrGDx9qtWLk24jXPlrda3XECNkYhJK:iUmcMbLGz7anzlKsi2XP9AzvAn6o
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C3F2B31756854752E93803786C23572C0FA5BC0DE2D3E7BF1DA2698B3972B708E4E62C
sha3_384: fee0a4d93b957221e20c7fe7af606a06f32408fa87f5f542a3a1b9497ef888fa03d44cdfb881231a998df74aeccd17cd
ep_bytes: ff250020400000000000000000000000
timestamp: 2012-01-29 23:11:59

Version Info:
Translation: 0x0000 0x04b0
FileDescription: Steam Cracker 2012
FileVersion: 1.0.0.0
InternalName: Steam Cracker 2012.exe
LegalCopyright: Copyright ©  2012
OriginalFilename: Steam Cracker 2012.exe
ProductName: Steam Cracker 2012
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/PSW.Agent.OSO also known as:

FireEye	Generic.mg.02ea880df914281f
McAfee	GenericRXHK-IE!02EA880DF914
Cybereason	malicious.6815cf
BitDefenderTheta	Gen:NN.ZemsilCO.36250.cq0@a0U7ALd
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/PSW.Agent.OSO
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSIL.Tpyn.chu
F-Secure	Trojan.TR/Spy.Gen
McAfee-GW-Edition	GenericRXHK-IE!02EA880DF914
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	TR/Spy.Gen
Xcitium	Malware@#1bjp53ary06dn
ZoneAlarm	HEUR:Trojan.MSIL.Tpyn.chu
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.NQK!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

How to remove MSIL/PSW.Agent.OSO?

MSIL/PSW.Agent.OSO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X