MSIL:GenMalicious-R [Trj] removal instruction

The MSIL:GenMalicious-R [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL:GenMalicious-R [Trj] virus can do?

• Injection (inter-process)
• Injection (Process Hollowing)
• Executable code extraction
• Injection with CreateRemoteThread in a remote process
• Attempts to connect to a dead IP:Port (3 unique times)
• Creates RWX memory
• A process attempted to delay the analysis task.
• At least one IP Address, Domain, or File Name was found in a crypto call
• Reads data out of its own binary image
• A process created a hidden window
• Performs some HTTP requests
• Uses Windows utilities for basic functionality
• Executed a process and injected code into it, probably while unpacking
• Attempts to remove evidence of file being downloaded from the Internet
• A process was set to shut the system down when terminated
• Installs itself for autorun at Windows startup
• Exhibits behavior characteristic of Nanocore RAT
• Creates a hidden or system file
• Creates a copy of itself
• Collects information to fingerprint the system

Related domains:

How to determine MSIL:GenMalicious-R [Trj]?

File Info:
crc32: C44BC3B7
md5: a857426ea4e38ccfaf2bf76a7c90ad1a
name: A857426EA4E38CCFAF2BF76A7C90AD1A.mlw
sha1: f3d951f4fb4fc67323ab64f1fad23f2b8604f26f
sha256: 4814696fe561cfc86356835e2bf83a6285ea9acb4f3290c12fbb07743c1f2af1
sha512: 8d37c55e95ca443f81f269c686b43fe34560e14006c034bc6af3a744c834c05443e5ec8a2cafb1bfbd2fdbca6f5da8a4dea1f4be1f50334a7659f4fee0074c80
ssdeep: 12288:Mygn5nZsrK1jwASwLHjZz0Z+pzCGOOv0Pf4bXxflEmq40Xf5GslQb:MyG3xTaZ+0qMPQTEdphVK
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
Assembly Version: 0.0.0.0
InternalName: random.exe
FileVersion: 10.0.19041.0
CompanyName: Microsoft Corporation
Comments: Microsoftxae Logon Server Test Utility
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.19041.0
FileDescription: nltestrk.exe
OriginalFilename: random.exe

MSIL:GenMalicious-R [Trj] also known as:

How to remove MSIL:GenMalicious-R [Trj]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.