MSIL/Spy.Agent.CT removal tips

The MSIL/Spy.Agent.CT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Spy.Agent.CT virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Creates a copy of itself
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/Spy.Agent.CT?


File Info:
crc32: 0AA96822
md5: 8b4a4d7c6bb85dd120ae54a7407d9c6c
name: 9n1tsd9ae6us.jpg
sha1: f964ed627dc3598a8e547ea7dfe73a0ef0080e38
sha256: 29975d720f9ca2b5f97bf992636449c0d38a50ccfaaf8be278f935a0592a359b
sha512: bcf43b9f1cdf205a3aa550ccb7175d4a0fa89a94cec15f41a03defa330abe1a933d0d7bbf3d0d51e0b0b02158cab14f9767293f6994decdeb1f861e7029253e4
ssdeep: 3072:agRKMLDzgMQIEUOSVBC+LcbNSmkpe4J+zSWq1sE+0ef:Nz2InOS++uEmU+XE+0
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 Microsoft Inc. 2010
Assembly Version: 4.2.0.0
InternalName: debug.exe
FileVersion: 4.2
CompanyName: Microsoft Inc.
ProductVersion: 4.2
FileDescription: debug
OriginalFilename: debug.exe

MSIL/Spy.Agent.CT also known as:

MicroWorld-eScan	Trojan.Agent.CPCB
CAT-QuickHeal	Trojan.GenericFC.S6059611
McAfee	GenericRXCW-NM!8B4A4D7C6BB8
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 003fbee91 )
BitDefender	Trojan.Agent.CPCB
K7GW	Trojan ( 003fbee91 )
Cybereason	malicious.c6bb85
Arcabit	Trojan.Agent.CPCB
TrendMicro	TROJ_GEN.R002C0DK519
ESET-NOD32	a variant of MSIL/Spy.Agent.CT.gen
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Mdrop-7173599-0
Kaspersky	HEUR:Trojan.MSIL.Generic
Alibaba	Trojan:Win32/Generic.82f3aac0
NANO-Antivirus	Trojan.Win32.Mlw.gfxxus
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1005103
DrWeb	Trojan.DownLoader25.32494
Invincea	heuristic
McAfee-GW-Edition	GenericRXCW-NM!8B4A4D7C6BB8
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.8b4a4d7c6bb85dd1
Emsisoft	Trojan.Agent.CPCB (B)
SentinelOne	DFI – Malicious PE
Webroot	Trojan.Dropper
Avira	HEUR/AGEN.1005103
Fortinet	MSIL/Agent.CT!tr
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:Win32/Tiggre!rfn
ZoneAlarm	HEUR:Trojan.MSIL.Generic
AhnLab-V3	Trojan/Win32.Agent.C2892737
Acronis	suspicious
ALYac	Trojan.Agent.CPCB
MAX	malware (ai score=100)
Ad-Aware	Trojan.Agent.CPCB
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DK519
Rising	Spyware.Agent!8.C6 (TFE:C:5tkWWHOueLT)
Ikarus	Trojan.MSIL.Spy
eGambit	RAT.AAR
GData	Trojan.Agent.CPCB
BitDefenderTheta	Gen:NN.ZemsilF.33556.jm0@aGLiMAc
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.7c5

How to remove MSIL/Spy.Agent.CT?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/Spy.Agent.CT removal tips