MSIL/TrojanDownloader.Agent.NDX removal

The MSIL/TrojanDownloader.Agent.NDX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.NDX virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/TrojanDownloader.Agent.NDX?


File Info:
name: 7E966FD078E024071C42.mlw
path: /opt/CAPEv2/storage/binaries/6998c07c0a8d9ea00d8d70ce6f4e5d8ef23d0ab9ed439424a576d8f372d4c89b
crc32: AD2CC81E
md5: 7e966fd078e024071c42831958ee3134
sha1: 4c39ba75a43950e943307d2d8515551e3e037b8c
sha256: 6998c07c0a8d9ea00d8d70ce6f4e5d8ef23d0ab9ed439424a576d8f372d4c89b
sha512: e3ba911c251657fc911997e1b186de91f95059b46af0346abf36956636fe13de3c7dfc640650a0aa7d63afa6108a4742bb17bcacd4a0025ffcd239c971c6f6f6
ssdeep: 384:oG/bGj1zm99rLozmeLIwOxnLa3/AbmF+yA8HsPTWInfVL4ybeW:oCbga99PozNLEgAlyALPTWCB4C/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T135848D706E57A099D4FE47F1391A92038FEE6DED19B8C362213073390EF53AD4A56272
sha3_384: b9e0e624d97f90545cd29ce75769f07de487fdd5f60335115e8154fb71ddce0c247e028a3818b2ce958b822957d1ceea
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-04 23:58:06

Version Info:
Translation: 0x0000 0x04b0
Comments: Creative Cloud Desktop
CompanyName: Adobe Inc.
FileDescription: Creative Cloud Desktop
FileVersion: 5.3.1.470
InternalName: keee.exe
LegalCopyright: © 2019-2020 Adobe. All rights reserved.
LegalTrademarks: 
OriginalFilename: keee.exe
ProductName: Creative Cloud Desktop
ProductVersion: 5.3.1.470
Assembly Version: 5.3.1.470

MSIL/TrojanDownloader.Agent.NDX also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
FireEye	Generic.mg.7e966fd078e02407
Alibaba	Trojan:MSIL/Generic.a78f7cdd
Cyren	W32/MSIL_Agent.DMO.gen!Eldorado
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.NDX
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan-Downloader.MSIL.PsDownload.gen
Avast	TrojanX-gen [Trj]
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
VBA32	Downloader.MSIL.gen
Malwarebytes	Trojan.Downloader.MSIL.Generic
Rising	Trojan.Generic/MSIL@AI.90 (RDM.MSIL:aZ9v5bOjTmkBQ9ZUdJ437A)
Ikarus	Win32.Outbreak
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34606.xm0@aqIqIXb
AVG	TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/TrojanDownloader.Agent.NDX?

MSIL/TrojanDownloader.Agent.NDX removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X