Troj/ILAgent-I removal guide

The Troj/ILAgent-I is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/ILAgent-I virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the DLInjector04 malware family

How to determine Troj/ILAgent-I?


File Info:
name: 3133D3642BFA4A27451D.mlw
path: /opt/CAPEv2/storage/binaries/ac2f25abe3976c01ff6792b10b6bc148fb7ee55ce332cf2e90af1dfce5aca928
crc32: E3FC4FB4
md5: 3133d3642bfa4a27451dc4ba649d0c50
sha1: 0142c0c8da9add92f19ea58ed9e380bb8c13725a
sha256: ac2f25abe3976c01ff6792b10b6bc148fb7ee55ce332cf2e90af1dfce5aca928
sha512: 7f38e49614004d06dfb6fdcab3360b24d120a7e2b4fe486f32344ec6428255c939bacaab654695a1e0769ecfd4f9964edcc31d2cbbf0d9e89144af0c2c6ebbc2
ssdeep: 98304:pa9Z1yOixQvHGom5W5dS6gzuToeVdbGftiKhiEs5PXOrBGozkojbCU8c:eZ1yOiupjIzuTbafYdsfkojbC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F436EF9A31BCF3B39036DC2259E6A96BE99DE0031F00DC2C959753660CAA3D1C1FB65D
sha3_384: 54e83aa2c79340f7e32522455175ab219977fae307acd52b7d79f9b6e15804863381c1703e5a3421e146a4d32fab8e65
ep_bytes: ff250020400000000000000000000000
timestamp: 2024-01-07 15:03:10

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 1.0.0.0
InternalName: newrock.exe
LegalCopyright:  
OriginalFilename: newrock.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Troj/ILAgent-I also known as:

Bkav	W32.AIDetectMalware.CS
DrWeb	Trojan.MulDropNET.43
MicroWorld-eScan	Gen:Variant.MSIL.Krypt.41
Skyhigh	BehavesLike.Win32.Generic.rc
McAfee	GenericRXPI-VQ!3133D3642BFA
Malwarebytes	Trojan.Crypt.MSIL.Generic
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Ransomware ( 005a8b921 )
K7GW	Ransomware ( 005a8b921 )
Cybereason	malicious.8da9ad
BitDefenderTheta	Gen:NN.ZemsilF.36680.@p0@aqcnYPk
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.UZA
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Msilzilla-10018301-0
Kaspersky	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
BitDefender	Gen:Variant.MSIL.Krypt.41
Avast	Win32:DropperX-gen [Drp]
Emsisoft	Gen:Variant.MSIL.Krypt.41 (B)
F-Secure	Heuristic.HEUR/AGEN.1365025
VIPRE	Gen:Variant.MSIL.Krypt.41
Sophos	Troj/ILAgent-I
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.MSIL.Krypt.41
Varist	W32/MSIL_Kryptik.FFY.gen!Eldorado
Avira	HEUR/AGEN.1365025
MAX	malware (ai score=85)
Kingsoft	malware.kb.c.995
Arcabit	Trojan.MSIL.Krypt.41
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Microsoft	Trojan:MSIL/Mokes.B!MTB
Google	Detected
AhnLab-V3	Malware/Win.Generic.C4478643
VBA32	Trojan.MSIL.Injector.gen
Cylance	unsafe
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
Ikarus	Trojan.MSIL.Krypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FFMZ!tr
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Troj/ILAgent-I?

Troj/ILAgent-I removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X