Categories: Malware

Troj/MSIL-NCH removal guide

The Troj/MSIL-NCH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Troj/MSIL-NCH virus can do?

Creates RWX memory
The binary likely contains encrypted or compressed data.
Creates a copy of itself

How to determine Troj/MSIL-NCH?


File Info:
crc32: E7BB6097md5: d32a8b9ac929389eb0814d3240f1536aname: oyoyobabyprotected.exesha1: 04598628dfaa2c9d67aaf4f862b246da71eca4cdsha256: cd15357149112d08a074f8621968509f22bf8cf48dd679a93b916e5cddc192dcsha512: 9e2e524fb75f197b2d2b5347278a4c6e7b877e983fab35cda33a44d3f96ceea3dea5346e11ad34657fa4e8f36176d3f7da8b53b77b1287160204ee6d92d55545ssdeep: 6144:Dw2gwmR4kGFLwIsClkbTSTnr8C8qxCwaRaQu18jGLDgmgkDDoVqL4n472D5o4oZ:D6wevhvm8C8qRddDQqLSIktype: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright KadenCreate 2019Assembly Version: 1.0.0.0InternalName: KadenCreate.exeFileVersion: 1.0.0.0CompanyName: LegalTrademarks: Comments: ProductName: KadenCreateProductVersion: 1.0.0.0FileDescription: KadenCreateOriginalFilename: KadenCreate.exe

Troj/MSIL-NCH also known as:

DrWeb	Trojan.Packed2.41837
MicroWorld-eScan	Gen:Variant.MSILPerseus.200939
FireEye	Generic.mg.d32a8b9ac929389e
CAT-QuickHeal	Trojan.MSIL
McAfee	RDN/Generic.dx
Malwarebytes	Trojan.Crypt.MSIL
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 700000121 )
BitDefender	Gen:Variant.MSILPerseus.200939
K7GW	Trojan ( 700000121 )
Cybereason	malicious.8dfaa2
TrendMicro	TROJ_GEN.R002C0WK619
BitDefenderTheta	Gen:NN.ZemsilF.32250.Em0@auiSkFl
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
GData	Gen:Variant.MSILPerseus.200939
Kaspersky	HEUR:Trojan.MSIL.Disfa.gen
Alibaba	Trojan:Win32/Starter.ali2000005
AegisLab	Trojan.MSIL.Disfa.4!c
Rising	Trojan.Kryptik!8.8 (TFE:C:t1aidM5xDSV)
Ad-Aware	Gen:Variant.MSILPerseus.200939
Sophos	Troj/MSIL-NCH
Comodo	Malware@#23lyif7e07v2e
F-Secure	Trojan.TR/AD.HawkEyeKeylogger.tbxxr
Zillya	Trojan.Kryptik.Win32.1826672
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Trapmine	suspicious.low.ml.score
Ikarus	Trojan.MSIL.Crypt
Cyren	W32/Trojan.BXZH-0244
Jiangmin	Trojan.Generic.ehfvl
Avira	TR/AD.HawkEyeKeylogger.tbxxr
MAX	malware (ai score=89)
Endgame	malicious (moderate confidence)
Arcabit	Trojan.MSILPerseus.D310EB
ZoneAlarm	HEUR:Trojan.MSIL.Disfa.gen
AhnLab-V3	Malware/Win32.RL_Generic.C3545815
Acronis	suspicious
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.Agent.HawkEye
Cylance	Unsafe
Panda	Trj/CI.A
ESET-NOD32	a variant of MSIL/Kryptik.QME
TrendMicro-HouseCall	TROJ_GEN.R002C0WK619
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.73686406.susgen
Fortinet	MSIL/Kryptik.QME!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.593