Should I remove “MSIL/TrojanDownloader.Agent.GGF”?

The MSIL/TrojanDownloader.Agent.GGF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.GGF virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/TrojanDownloader.Agent.GGF?


File Info:
name: 9C8193531B06F9E04B38.mlw
path: /opt/CAPEv2/storage/binaries/388f9a2180d3304e2df8987b26f15035da92a86c0f6262ab57c0dc4d036fd7d4
crc32: 637C07D0
md5: 9c8193531b06f9e04b38b013a774722e
sha1: 9ae7e9e35ad81b0e0d39de79eddb3b14fd6dcc85
sha256: 388f9a2180d3304e2df8987b26f15035da92a86c0f6262ab57c0dc4d036fd7d4
sha512: da499864806900d50d4e5cc01e17f5dc71c4001fa79e454f7eadec7d3edaf1dd1a0bae6b6862acd5164621e4cf4fa8c8c47ca3a357db99c4592766c9893c5e0d
ssdeep: 96:lMRRtYHdVeHPJprf+vv83VhZBTePgaYEWkeRFQIstZJo+OpMIU4kzNt:2RRCH3eHPjfz3NkeTQIs/G7vUv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19FF10904A3E84B37EDB94B7149B3D7505B79F703D933CA1E98CA021B5D22B506DA2B72
sha3_384: 4a0e2c83fb6e1e6872dab4bb3896cdf6936a908c1dbcbe90e93026eb6fd621cce6676bda78b3b3a86246fd7eaed07215
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-07-29 18:39:03

Version Info:
Translation: 0x0000 0x04b0
Comments: Google Chrome
CompanyName: Google Chrome
FileDescription: chome_exe
FileVersion: 67.0.100.99
InternalName: 111.exe
LegalCopyright: Copyright 2017 Google Inc. All rights reserved.
OriginalFilename: 111.exe
ProductName: Google Chrome
ProductVersion: 67.0.100.99
Assembly Version: 67.0.100.99

MSIL/TrojanDownloader.Agent.GGF also known as:

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.13574
FireEye	Generic.mg.9c8193531b06f9e0
McAfee	Artemis!9C8193531B06
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/Dotdo.d4bd529c
K7GW	Trojan ( 700000121 )
K7AntiVirus	Trojan ( 700000121 )
Arcabit	IL:Trojan.MSILZilla.D3506
BitDefenderTheta	Gen:NN.ZemsilF.36196.am0@a4gTgFm
Cyren	W32/MSIL_Downloader.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.GGF
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	IL:Trojan.MSILZilla.13574
Avast	Win32:TrojanX-gen [Trj]
Tencent	Msil.Trojan-Downloader.Ader.Gdhl
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1313700
VIPRE	IL:Trojan.MSILZilla.13574
TrendMicro	TROJ_GEN.R002C0GBR23
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	IL:Trojan.MSILZilla.13574 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1313700
Antiy-AVL	Trojan[Downloader]/MSIL.Agent
Xcitium	Malware@#2z0k2fsz3q057
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan.Multi.GenericML.xnet
GData	IL:Trojan.MSILZilla.13574
Google	Detected
AhnLab-V3	Malware/Win32.RL_Generic.C4136159
ALYac	IL:Trojan.MSILZilla.13574
MAX	malware (ai score=83)
Malwarebytes	Trojan.PasswordStealer.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002C0GBR23
Rising	Trojan.FakeChrome!1.9C7B (CLASSIC)
Ikarus	AdWare.Dotdo
MaxSecure	Trojan.Malware.82199810.susgen
Fortinet	MSIL/Generic.AP.274570!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.31b06f
DeepInstinct	MALICIOUS

How to remove MSIL/TrojanDownloader.Agent.GGF?

MSIL/TrojanDownloader.Agent.GGF removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X