Categories: Malware

MSILDrop.6 removal guide

The MSILDrop.6 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSILDrop.6 virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Uses Windows utilities for basic functionality
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
Deletes executed files from disk

How to determine MSILDrop.6?


File Info:
name: 4429291AB859E9981194.mlwpath: /opt/CAPEv2/storage/binaries/91f2df0132ee92d82e6e0fd8093205916f4d551ed2472ba40be078609c5849e2crc32: B92149B7md5: 4429291ab859e9981194e111b26cfd20sha1: 2ab55bb9a43ac18a8846e8764362f6e0731a5c2csha256: 91f2df0132ee92d82e6e0fd8093205916f4d551ed2472ba40be078609c5849e2sha512: 410e205dcd09ad1afe769af77246e9d71478dd7a1f407a458652caf7e0df47e442ec2c29ef6415ad4a6d7806e4795811be4a4e173e77fa4e86be60381875147fssdeep: 768:1Faaz/rKFZCWZm47mqvBzIb4uMvgNG3Cr63lhUOIHyX4o1U2boqSYrr99zYWHti:piQ4SqJUVMvbg67Iw1UmoqSYn9+WHQtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E4337C009278676FE17E03F58085530017F6D23B5A41FB0A1CE162EF297AFE087596CBsha3_384: cfb59d9e4d3f5a5e5c18ea151743b08c5de70dc2749abcb366f778008d64c5a60a703bfbd24893ebef02c86186af63baep_bytes: ff250020400000000000000000000000timestamp: 2012-01-17 06:57:09
Version Info:
Translation: 0x0000 0x04b0Comments: wersvcCompanyName: MicrosoftFileDescription: wersvcFileVersion: 1.0.0.0InternalName: wersvc.exeLegalCopyright: Copyright © Microsoft 2011OriginalFilename: wersvc.exeProductName: wersvcProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

MSILDrop.6 also known as:

Lionic	Trojan.Win32.Fullscreen.j!c
DrWeb	Trojan.MulDrop6.60971
MicroWorld-eScan	Gen:Variant.MSILDrop.6
CAT-QuickHeal	Trojan.GenericFC.S26036444
Skyhigh	Artemis!Trojan
McAfee	Artemis!4429291AB859
Cylance	unsafe
Zillya	Trojan.LockScreen.Win32.9300
K7AntiVirus	Trojan ( 00530c291 )
Alibaba	Trojan:MSIL/LockScreen.6cb8fc9a
K7GW	Trojan ( 00530c291 )
Cybereason	malicious.9a43ac
Arcabit	Trojan.MSILDrop.6
BitDefenderTheta	Gen:NN.ZemsilF.36680.dm1@aKGYoFj
Symantec	Trojan.Gen.MBT
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/LockScreen.O
Cynet	Malicious (score: 99)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.MSILDrop.6
NANO-Antivirus	Trojan.Win32.Fullscreen.oysgu
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Trojan.Generic.Bkjl
Emsisoft	Gen:Variant.MSILDrop.6 (B)
F-Secure	Heuristic.HEUR/AGEN.1329602
VIPRE	Gen:Variant.MSILDrop.6
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.Fullscreen
Jiangmin	Trojan.Generic.dwnrw
Webroot	W32.Trojan.Gen
Varist	W32/S-3e5dc3f2!Eldorado
Avira	HEUR/AGEN.1329602
Antiy-AVL	Trojan[Ransom]/Win32.Fullscreen
Kingsoft	Win32.Trojan.Generic.a
Xcitium	Malware@#1xh0iil89zgec
Microsoft	Trojan:Win32/Ditertag.A
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.MSILDrop.6
Google	Detected
AhnLab-V3	Trojan/Win32.LockScreen.C3275701
Malwarebytes	Generic.Malware/Suspicious
Panda	Generic Malware
Rising	Trojan.Generic!8.C3 (CLOUD)
Yandex	Trojan.Agent!vc2IypocMbo
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.3643866.susgen
Fortinet	MSIL/LockScreen.O!tr
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)