MSIL/TrojanDownloader.Agent.NSC removal tips

The MSIL/TrojanDownloader.Agent.NSC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.NSC virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/TrojanDownloader.Agent.NSC?


File Info:
name: DC17E55C4C4B4A9D83EC.mlw
path: /opt/CAPEv2/storage/binaries/f2494d0bea7a6245e1af2a525e3ed791f16ac6824fd61bede6be3744a3b9f423
crc32: 3CDA1AF7
md5: dc17e55c4c4b4a9d83eca6ec39bb55fc
sha1: 32e2d3c2838449ec63756da14467d3801234a79e
sha256: f2494d0bea7a6245e1af2a525e3ed791f16ac6824fd61bede6be3744a3b9f423
sha512: f82ce23e9c247346a41394bfbb11fe9de2510d98f6c293bd3e99e34841f2dd66aa6f100f5b67b856c5ac90cc9033e6c1ba0ff6f20eb110418cb70e850b3ff0f7
ssdeep: 12288:6kmor5AaM60VYZBL0f1D2mT3sxJnWZQzjFeM6DJOjB9sTTHymDLxJ:uub543UnYQb6VOY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13875C6F4A0BB8092F6479D81253CF9E105B231A3ADDE0939136A7B04CFBFD553A45A4E
sha3_384: b056b4ccbb984d265ebcd1d587418a16d9e7d43a992d7509ab727d202a67fcfad51bc931256f3e2cb9d86852f9e4e15f
ep_bytes: ff250020400034443541393030303033
timestamp: 2044-04-10 22:19:27

Version Info:
Translation: 0x0000 0x04b0
Comments: Newsletter Software SuperMailer (x64)
CompanyName: Mirko Böer
FileDescription: Newsletter Software SuperMailer (x64)
FileVersion: 10.90.0.2040
InternalName: Ulvyc.exe
LegalCopyright: Copyright © 2001-2019 Mirko Böer
LegalTrademarks: 
OriginalFilename: Ulvyc.exe
ProductName: SuperMailer
ProductVersion: 10.90.0.2040
Assembly Version: 10.90.0.2040

MSIL/TrojanDownloader.Agent.NSC also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.Scarsi.4!c
MicroWorld-eScan	Trojan.GenericKD.62706257
ClamAV	Win.Packed.Msilzilla-9975992-0
McAfee	Artemis!DC17E55C4C4B
Cylance	Unsafe
Zillya	Trojan.Scarsi.Win32.6961
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:MSIL/Scarsi.25f7aca4
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.283844
Cyren	W32/ABRisk.MNRH-5950
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.NSC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Scarsi.gen
BitDefender	Trojan.GenericKD.62706257
NANO-Antivirus	Trojan.Win32.Scarsi.jtcgds
ViRobot	Trojan.Win32.Z.Agent.1696256.D
Avast	Win32:DropperX-gen [Drp]
Tencent	Msil.Trojan-Downloader.Ader.Kcnw
Ad-Aware	Trojan.GenericKD.62706257
Emsisoft	Trojan.GenericKD.62706257 (B)
DrWeb	Trojan.DownLoader45.25003
VIPRE	Trojan.GenericKD.62706257
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.dc17e55c4c4b4a9d
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1202166
Antiy-AVL	Trojan/MSIL.Scarsi
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Generic.D3BCD251
GData	Trojan.GenericKD.62706257
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5278416
Acronis	suspicious
ALYac	Trojan.GenericKD.62706257
MAX	malware (ai score=100)
Malwarebytes	Bladabindi.Backdoor.Bot.DDS
TrendMicro-HouseCall	TROJ_GEN.R002H07JC22
Rising	Downloader.Agent!8.B23 (CLOUD)
Ikarus	Trojan.Agent
MaxSecure	Trojan.Malware.73692792.susgen
Fortinet	MSIL/Agent.NSC!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34796.Nn0@aOuig3p
AVG	Win32:DropperX-gen [Drp]
Panda	Trj/Chgt.AA
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSIL/TrojanDownloader.Agent.NSC?

MSIL/TrojanDownloader.Agent.NSC removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X