Categories: Trojan

What is “MSIL/TrojanDownloader.Agent.GYM”?

The MSIL/TrojanDownloader.Agent.GYM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What MSIL/TrojanDownloader.Agent.GYM virus can do?

  • Presents an Authenticode digital signature
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine MSIL/TrojanDownloader.Agent.GYM?


File Info:

crc32: 3DD316DAmd5: d3dd64a09b7e6d23b49e7cfa0dcc7a1fname: upload_filesha1: cd197ffaa8a933d304b2f6f208a4a805ada97190sha256: b6138f3435c7c4049fa524e698b6d167b09f6105572931a94b92759cffddd8d6sha512: 43ee4a7ad3d145b6db6305a1d19311231bcce98b76eec60f658cfbd8ccaa1d8d557cb7232003428c76e041d03aa9045e6b49c38d6c7e03bf4009712304f4fb94ssdeep: 768:XopLoQ4j42om3Y4oPhgZEUQ4idwA/+A8C7QAx1NszPbZVsaoKSLyhyFx5rQj3rvR:MLoXnp3SsXwTXPb8dBNHh9HrCzUf/type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

LegalCopyright: xa9 x5f17x5f17x5f17. All rights reserved.Assembly Version: 3.1.8.8FileVersion: 0.4.0.3CompanyName: x543ex543ex543eLegalTrademarks: x543ex543ex543eComments: x5f17x5f17x5f17 x5f17x5f17x5f17ProductName: x543ex543ex543e x5f17x5f17x5f17ProductVersion: 3.1.8.8FileDescription: x543ex543ex543e x5f17x5f17x5f17OriginalFilename: x543ex543ex543e x5f17x5f17x5f17.exeTranslation: 0x0409 0x0514

MSIL/TrojanDownloader.Agent.GYM also known as:

MicroWorld-eScan Trojan.GenericKD.34877929
FireEye Generic.mg.d3dd64a09b7e6d23
CAT-QuickHeal Trojan.Wacatac
McAfee RDN/GenericM
Cylance Unsafe
K7AntiVirus Trojan-Downloader ( 00570f721 )
BitDefender Trojan.GenericKD.34877929
K7GW Trojan-Downloader ( 00570f721 )
TrendMicro TROJ_GEN.R03BC0PJS20
BitDefenderTheta Gen:NN.ZemsilF.34590.fm1@aWvCIEhi
Cyren W32/MSIL_Kryptik.BXZ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:DangerousSig [Trj]
Alibaba Trojan:MSIL/DangerousSig.80a7b663
Ad-Aware Trojan.GenericKD.34877929
Sophos Mal/Generic-S
F-Secure Trojan.TR/Dldr.Agent.epola
Invincea Mal/Generic-S
McAfee-GW-Edition RDN/GenericM
Emsisoft Trojan.GenericKD.34877929 (B)
SentinelOne DFI – Malicious PE
Avira TR/Dldr.Agent.epola
Antiy-AVL Trojan[Downloader]/MSIL.Agent
Arcabit Trojan.Generic.D21431E9
GData Trojan.GenericKD.34877929
ALYac Trojan.GenericKD.34877929
MAX malware (ai score=82)
Malwarebytes Trojan.MalPack.GZ.Generic
Panda Trj/GdSda.A
Zoner Trojan.Win32.96570
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.GYM
TrendMicro-HouseCall TROJ_GEN.R03BC0PJS20
Tencent Msil.Trojan-downloader.Agent.Wskb
Yandex Trojan.Igent.bUGcPa.29
Ikarus Trojan.MSIL.Inject
Fortinet MSIL/Agent.GWR!tr.dldr
AVG Win32:DangerousSig [Trj]
CrowdStrike win/malicious_confidence_70% (W)
Qihoo-360 Generic/Trojan.d93

How to remove MSIL/TrojanDownloader.Agent.GYM?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Application.Babar.402455 removal tips

The Application.Babar.402455 is considered dangerous by lots of security experts. When this infection is active,…

1 min ago

Malware.AI.4231428423 removal

The Malware.AI.4231428423 is considered dangerous by lots of security experts. When this infection is active,…

27 mins ago

Malware.AI.1993670149 information

The Malware.AI.1993670149 is considered dangerous by lots of security experts. When this infection is active,…

30 mins ago

Win32:Webprefix [Trj] information

The Win32:Webprefix [Trj] is considered dangerous by lots of security experts. When this infection is…

30 mins ago

SpamTool.HackTool.SpamBot.DDS malicious file

The SpamTool.HackTool.SpamBot.DDS is considered dangerous by lots of security experts. When this infection is active,…

35 mins ago

UDS:Trojan-Downloader.Win32.Agent.xxzvud removal

The UDS:Trojan-Downloader.Win32.Agent.xxzvud is considered dangerous by lots of security experts. When this infection is active,…

40 mins ago