MSIL/TrojanDropper.Agent.FTO removal tips

The MSIL/TrojanDropper.Agent.FTO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/TrojanDropper.Agent.FTO virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine MSIL/TrojanDropper.Agent.FTO?

File Info:
name: 3C6A383546AF73949583.mlw
path: /opt/CAPEv2/storage/binaries/46d6a0afeeb765fe130c0ec64bcb58199616d19f19ddd56c658d64affcfa38b4
crc32: 4FE4A19B
md5: 3c6a383546af7394958332caa5718a9e
sha1: 37c4c9c474134e994d602f34a47d80c945cbb5ef
sha256: 46d6a0afeeb765fe130c0ec64bcb58199616d19f19ddd56c658d64affcfa38b4
sha512: 9e89dde64afc57f6ed05a71a53db52bf3fa15132bb8a9ce7bf8b101bedabd30239b8600a867655a01f5666cd726c17ee4abcc1c308f82dc74f998da34331219a
ssdeep: 12288:jy90gmrpSmIwi/42zKWtTK3AFDOixPkUo0Dk0gbX1q8nmx83FR:jy0rzidtPcOPkdwk0K1qLc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T162E41243BBDC8073C9B127B04AF913470B37BCE29F6896DF26826A4644726C056757BB
sha3_384: 1a760c8fd390ec6d5b5b268e1e99c9b5d0cedc6688287e80c7f3d3003647e2c66f922636857122edb246248ee5bfa527
ep_bytes: e803070000e905000000cccccccccc6a
timestamp: 2016-07-16 01:42:10

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 11.00.14393.0 (rs1_release.160715-1616)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.14393.0
Translation: 0x0409 0x04b0

MSIL/TrojanDropper.Agent.FTO also known as:

How to remove MSIL/TrojanDropper.Agent.FTO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.