How to remove “Trojan:MSIL/Fanny”?

The Trojan:MSIL/Fanny is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/Fanny virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Trojan:MSIL/Fanny?


File Info:
name: E07AF77DEAC79FA1C34B.mlw
path: /opt/CAPEv2/storage/binaries/33ebd575fe75bfd32fc0b1084a52f0cb026e7fb51bb7665a817a7dbcceb73615
crc32: B08933F2
md5: e07af77deac79fa1c34bc1431ad8440f
sha1: 9fdd367c74635fbae424ef0eb317e617735da0cb
sha256: 33ebd575fe75bfd32fc0b1084a52f0cb026e7fb51bb7665a817a7dbcceb73615
sha512: 5bff398af3388cc5bbdebf4f944e288d9e5de4ddbf2d24a8a6951432d00eb3483c929153a834b6bb0f0b49c77406a890dd7f9d83125c50757de1f3bc0588410f
ssdeep: 96:AqYmEMnzUfIkexMUf3Ecm/5K5cHsXzifz58l8DN+HAoK:pYtxfIBx45KqHs+zlD8q
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T157E1D75A7BD80A26E8EF4F781AB313119772FD035A33D79F4CC4116909327285629FE4
sha3_384: 377ecc6fa00b993237d8302ea33f5995de0a2a3e73569e13d5e4c37479b71efbbc472e79423ee4fecd9d34c1107e8a63
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-01-13 22:05:33

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: 9252qbi4.dll
LegalCopyright:  
OriginalFilename: 9252qbi4.dll
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan:MSIL/Fanny also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Worm.MSIL.Agent.o!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.599033
FireEye	Generic.mg.e07af77deac79fa1
Skyhigh	Trojan-FTTC!E07AF77DEAC7
ALYac	Gen:Variant.Bulz.599033
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Worm:MSIL/Fanny.7a930fe5
K7GW	Trojan ( 00569f861 )
K7AntiVirus	Trojan ( 00569f861 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Agent.UJ
APEX	Malicious
ClamAV	Win.Packed.Ursu-9757277-0
Kaspersky	HEUR:Worm.MSIL.Agent.gen
BitDefender	Gen:Variant.Bulz.599033
Avast	Win32:WormX-gen [Wrm]
Tencent	Worm.Msil.Agent.fa
TACHYON	Trojan/W32.DN-Agent.7168.AG
Emsisoft	Gen:Variant.Bulz.599033 (B)
F-Secure	Heuristic.HEUR/AGEN.1300930
DrWeb	Win32.HLLW.UsbmonNET.1
VIPRE	Gen:Variant.Bulz.599033
TrendMicro	Trojan.MSIL.LEMONDUCK.SM
Sophos	Troj/MSIL-PNL
Ikarus	Worm.MSIL.Agent
GData	MSIL.Trojan.Fanny.A
Jiangmin	Worm.MSIL.gtq
Varist	W32/Trojan.FBM.gen!Eldorado
Avira	HEUR/AGEN.1300930
Xcitium	Malware@#jo4srtbi19fn
Arcabit	Trojan.Bulz.D923F9
ZoneAlarm	HEUR:Worm.MSIL.Agent.gen
Microsoft	Trojan:MSIL/Fanny
Google	Detected
AhnLab-V3	Malware/Win.Generic.R419340
McAfee	GenericRXKZ-AA!E07AF77DEAC7
MAX	malware (ai score=87)
VBA32	Worm.MSIL.Usbmon.Heur
Malwarebytes	Trojan.MalPack.MSIL
TrendMicro-HouseCall	Trojan.MSIL.LEMONDUCK.SM
Rising	Trojan.DTLMiner!1.DB4F (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Worm.WIN32.MSIL.Agent.gen.010221
Fortinet	MSIL/Agent.UJ!worm
AVG	Win32:WormX-gen [Wrm]
DeepInstinct	MALICIOUS

How to remove Trojan:MSIL/Fanny?

Trojan:MSIL/Fanny removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X