Categories: Trojan

Trojan:MSIL/Sorano!rfn removal tips

The Trojan:MSIL/Sorano!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:MSIL/Sorano!rfn virus can do?

  • Network activity detected but not expressed in API logs
  • Unusual version info supplied for binary

How to determine Trojan:MSIL/Sorano!rfn?


File Info:

crc32: E8798DC5md5: d0c2de03f2bacb51181a80984762a9a6name: inject.exesha1: 0d25228ea5b4f17cafcd392d5f94c14fc8ac4effsha256: ae4d46ac6bf5f5d5a8828dcb59123891ad5b6865e1d859137d0eabb3b72965aasha512: ac2b39b5e6081acdff7297733bdad4b9bc42eb6058182b4ac0b9e6da4b5129d4f67befdc6147a9b2331bd48474ea8852f7ff52622ed5918430cb30a7f9293322ssdeep: 6144:phG1GUJA0jaOdjWxq2O5wAzuhnk9vsFcUge8zqb5wKpQF/ocGXZqR9Kim:pA1GUJAkaOdjWxq2O5wAzKkCge8zqb5type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9 Microsoft 2020Assembly Version: 1.0.0.0InternalName: yep.exeFileVersion: 1.0.0.0CompanyName: FileLegalTrademarks: Comments: FileProductName: FileProductVersion: 1.0.0.0FileDescription: FileOriginalFilename: yep.exe

Trojan:MSIL/Sorano!rfn also known as:

MicroWorld-eScan Gen:Variant.MSILPerseus.212702
FireEye Generic.mg.d0c2de03f2bacb51
CAT-QuickHeal Trojanpws.Msil
ALYac Gen:Variant.MSILPerseus.212702
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Spyware ( 0055727f1 )
BitDefender Gen:Variant.MSILPerseus.212702
K7GW Spyware ( 0055727f1 )
Cybereason malicious.ea5b4f
BitDefenderTheta Gen:NN.ZemsilF.34130.xm0@ae7wjCn
Symantec ML.Attribute.HighConfidence
TrendMicro-HouseCall TROJ_GEN.R03FC0PEP20
Paloalto generic.ml
Alibaba TrojanPSW:MSIL/Sorano.10165929
AegisLab Trojan.MSIL.Sorano.i!c
Tencent Msil.Trojan-qqpass.Qqrob.Wqwg
Ad-Aware Gen:Variant.MSILPerseus.212702
Sophos Mal/Generic-S
Comodo Malware@#3l1k66agzetcu
TrendMicro TROJ_GEN.R03FC0PEP20
Emsisoft Gen:Variant.MSILPerseus.212702 (B)
GData Gen:Variant.MSILPerseus.212702
Webroot W32.Trojan.Gen
Avira TR/Spy.Agent.fvudc
Antiy-AVL Trojan[PSW]/MSIL.Sorano
Microsoft Trojan:MSIL/Sorano!rfn
Arcabit Trojan.MSILPerseus.D33EDE
ZoneAlarm HEUR:Trojan-PSW.MSIL.Sorano.a
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Agent.C4115450
McAfee GenericRXKP-BV!D0C2DE03F2BA
MAX malware (ai score=87)
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.Sorano
APEX Malicious
ESET-NOD32 a variant of MSIL/Spy.Agent.CEI
Rising Spyware.Agent!8.C6 (CLOUD)
SentinelOne DFI – Malicious PE
eGambit Unsafe.AI_Score_91%
Fortinet MSIL/Sorano.A!tr.pws
Qihoo-360 Generic/Trojan.PSW.b90
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_90% (W)
MaxSecure Trojan.Malware.300983.susgen

How to remove Trojan:MSIL/Sorano!rfn?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Trojan.Win32.Agent.xboakk removal

The Trojan.Win32.Agent.xboakk is considered dangerous by lots of security experts. When this infection is active,…

55 mins ago

About “Worm.Win32.Vobfus.efoh” infection

The Worm.Win32.Vobfus.efoh is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Generic.Malware.Lco.500CC679 removal tips

The Generic.Malware.Lco.500CC679 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Trojan:Win32/Plugx.B malicious file

The Trojan:Win32/Plugx.B is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Should I remove “Malware.AI.4180628677”?

The Malware.AI.4180628677 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Application.Tool.Camerashy.A (file analysis)

The Application.Tool.Camerashy.A is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago