Trojan:MSIL/Fanny removal guide

The Trojan:MSIL/Fanny is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/Fanny virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Trojan:MSIL/Fanny?


File Info:
name: 33E7EA62012E608F84C2.mlw
path: /opt/CAPEv2/storage/binaries/c182b310447d0b95dea3502625e976613efc45c14abb3889df048302d2226e87
crc32: 78168BD3
md5: 33e7ea62012e608f84c28f17e815f538
sha1: 47b16cd43815d2d793340381fa078ea3354403ed
sha256: c182b310447d0b95dea3502625e976613efc45c14abb3889df048302d2226e87
sha512: cd1d183c3b27951c023b487647784d63c87b25d8cdd0a8183be01ad634e6d945798591ac2b97cc8de0e0cfaae2c0d1a3a0d517987832ad8dc53ae1623525b4d6
ssdeep: 96:rYqYmEMnzUfIkexMUf3Ecm/5K5pHBXzifz5br8DNsHdaLK:rhYtxfIBx45K3HB+zuDq9j
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1FFE1C55A7BEC0A2AE8AF5B781A73131197B2FD025A33D79F4CD4016909327641619FE1
sha3_384: 3838d4a4963be27ebcefd8c976f4ab569e889ef213a795380a99ffb7f016d602266ce4d508f2b0f926c9f80ef71a7fb3
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-01-17 17:47:05

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: nbjqljwm.dll
LegalCopyright:  
OriginalFilename: nbjqljwm.dll
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan:MSIL/Fanny also known as:

Bkav	W32.AIDetectMalware.CS
MicroWorld-eScan	Gen:Variant.Bulz.599033
FireEye	Generic.mg.33e7ea62012e608f
Skyhigh	Trojan-FTTC!33E7EA62012E
McAfee	GenericRXKZ-AA!33E7EA62012E
Malwarebytes	Trojan.MalPack.MSIL
VIPRE	Gen:Variant.Bulz.599033
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00569f861 )
BitDefender	Gen:Variant.Bulz.599033
K7GW	Trojan ( 00569f861 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.UJ
APEX	Malicious
TrendMicro-HouseCall	Trojan.MSIL.LEMONDUCK.SM
Avast	Win32:WormX-gen [Wrm]
ClamAV	Win.Packed.Ursu-9757277-0
Kaspersky	HEUR:Worm.MSIL.Agent.gen
Alibaba	Worm:MSIL/Fanny.32321eef
Tencent	Worm.Msil.Agent.fa
Emsisoft	Gen:Variant.Bulz.599033 (B)
Google	Detected
F-Secure	Heuristic.HEUR/AGEN.1300930
DrWeb	Win32.HLLW.UsbmonNET.1
Zillya	Worm.Agent.Win32.61396
TrendMicro	Trojan.MSIL.LEMONDUCK.SM
Sophos	Troj/MSIL-PNL
SentinelOne	Static AI – Malicious PE
Varist	W32/Trojan.FBM.gen!Eldorado
Avira	HEUR/AGEN.1300930
MAX	malware (ai score=85)
Antiy-AVL	Worm/MSIL.Agent
Microsoft	Trojan:MSIL/Fanny
Xcitium	Malware@#1p7urmofri4nh
Arcabit	Trojan.Bulz.D923F9
ZoneAlarm	HEUR:Worm.MSIL.Agent.gen
GData	MSIL.Trojan.Fanny.A
AhnLab-V3	Malware/Win.Generic.R419340
ALYac	Gen:Variant.Bulz.599033
TACHYON	Trojan/W32.DN-Agent.7168.AG
VBA32	Worm.MSIL.Usbmon.Heur
Cylance	unsafe
Rising	Trojan.DTLMiner!1.DB4F (CLASSIC)
Yandex	Worm.Agent!r9yo/InYbzs
Ikarus	Worm.MSIL.Agent
MaxSecure	Worm.WIN32.MSIL.Agent.gen.010221
Fortinet	MSIL/Agent.UJ!worm
AVG	Win32:WormX-gen [Wrm]
DeepInstinct	MALICIOUS
alibabacloud	Trojan:MSIL/Cridex

How to remove Trojan:MSIL/Fanny?

Trojan:MSIL/Fanny removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X