MSIL:MassLogger-G [Pws] removal guide

The MSIL:MassLogger-G [Pws] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL:MassLogger-G [Pws] virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL:MassLogger-G [Pws]?


File Info:
name: 4690DBB432B359EFA169.mlw
path: /opt/CAPEv2/storage/binaries/f8620bf28c2249d76bb810576e8cdbd54a311505ffd5df3c5a1c510e0856c22e
crc32: 94B36DD7
md5: 4690dbb432b359efa169dbadf60908d5
sha1: 14a52f3cf8a2039728311b9474a9e6b8f087fd1b
sha256: f8620bf28c2249d76bb810576e8cdbd54a311505ffd5df3c5a1c510e0856c22e
sha512: ed3b17bf8a7f3621bf64745c4c52c56d6e4eedfe7f94a18b6eb3c61a7ad12b47f8d4e6de5fdf0a3da76bacd3ec462339b1865e7977b8e42eaa1b770f4b6ed418
ssdeep: 6144:r6yzIcinPme6x3tUZGJhgvJLIIb8fbT1sIQKq4:rfzIcinepybh4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FD34644119D0302FE7E304F8EBFCA57E6714A1EF2F5974287461FE908B9A980861677B
sha3_384: 0cd88df72ddbf63723afce8a387a0feac7a92b6a7b9cc2f81cf6f6c3011b7573cb0d1f2eec77c32ce370ad6e730348bc
ep_bytes: ff250020400000000000000000000000
timestamp: 2069-12-18 23:45:33

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Daddy
FileVersion: 1.0.0.0
InternalName: Daddy.exe
LegalCopyright: Copyright (c) r3xq1 2021
LegalTrademarks: 
OriginalFilename: Daddy.exe
ProductName: Daddy
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL:MassLogger-G [Pws] also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.4694
FireEye	Generic.mg.4690dbb432b359ef
CAT-QuickHeal	Trojanpws.Msil
ALYac	IL:Trojan.MSILZilla.4694
K7AntiVirus	Spyware ( 0057e5b81 )
Alibaba	TrojanPSW:MSIL/Disco.63ea7b7e
K7GW	Spyware ( 0057e5b81 )
BitDefenderTheta	Gen:NN.ZemsilF.34062.pm0@aSPY1jg
Cyren	W32/MSIL_Troj.NT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.DIX
Kaspersky	HEUR:Trojan-PSW.MSIL.Disco.gen
BitDefender	IL:Trojan.MSILZilla.4694
Avast	MSIL:MassLogger-G [Pws]
Tencent	Msil.Trojan-qqpass.Qqrob.Pdme
Ad-Aware	IL:Trojan.MSILZilla.4694
Emsisoft	Trojan.Agent (A)
McAfee-GW-Edition	RDN/Generic PWS.y
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	IL:Trojan.MSILZilla.4694
Avira	HEUR/AGEN.1138205
MAX	malware (ai score=86)
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	IL:Trojan.MSILZilla.D1256
Microsoft	Trojan:Win32/Tiggre!rfn
Cynet	Malicious (score: 100)
McAfee	RDN/Generic PWS.y
VBA32	TrojanPSW.MSIL.Disco
APEX	Malicious
Ikarus	Trojan.MSIL.Spy
Fortinet	MSIL/Agent.DIX!tr.spy
AVG	MSIL:MassLogger-G [Pws]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)

How to remove MSIL:MassLogger-G [Pws]?

MSIL:MassLogger-G [Pws] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X