VirTool:MSIL/Deimos.A!MTB removal guide

The VirTool:MSIL/Deimos.A!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:MSIL/Deimos.A!MTB virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine VirTool:MSIL/Deimos.A!MTB?


File Info:
name: 4A6F19A3A77BE30E0222.mlw
path: /opt/CAPEv2/storage/binaries/efe9e1ec37fe6b3c9190eafaf0fce2e885c23f48c09409079b6fa84912a0c205
crc32: 5FCF43D6
md5: 4a6f19a3a77be30e02223d754b178293
sha1: 1887c841079908999c34a3e0cbdc7359b12b5e0b
sha256: efe9e1ec37fe6b3c9190eafaf0fce2e885c23f48c09409079b6fa84912a0c205
sha512: 0f7e273ffbbd381e13b1a5d3d54f5de496f7dd22b96431717c993ec90a1b5ee406dc0d6a21b3c822dc31acd22667a3c503d3276079f9c6109e3e5b1d966fd877
ssdeep: 768:y/yPSFQLgSoyPxkZjMTD2q4iLRbcwtPx157JARuFjlI:2wkZjMPmiJXtPx1jARh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A1D27CA1BBF88B36C5BA1BFA54B2410017B1EB025925FB5D2ED060CF5A33B4587117BB
sha3_384: 7d273644fcae9d656a05cbff04b34146296e028d64ef91356d49412ba40ca7ec130c351d61f799cc8f37f0322111e645
ep_bytes: ff250020400000000000000000000000
timestamp: 2092-04-24 21:59:06

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: FakeLogonScreen
FileVersion: 1.0.0.0
InternalName: FakeLogonScreen.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: FakeLogonScreen.exe
ProductName: FakeLogonScreen
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

VirTool:MSIL/Deimos.A!MTB also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Malware.Razy-9875031-0
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Gen:Variant.Razy.613081
Malwarebytes	Malware.AI.3712297050
BitDefender	Gen:Variant.Razy.613081
Cyren	W32/MSIL_Perseus.AT.gen!Eldorado
ESET-NOD32	a variant of MSIL/PSW.Agent.RSW
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-PSW.MSIL.Agent.gen
MicroWorld-eScan	Gen:Variant.Razy.613081
Sophos	ATK/FakeLogon-A
F-Secure	Heuristic.HEUR/AGEN.1130188
SentinelOne	Static AI – Suspicious PE
FireEye	Gen:Variant.Razy.613081
Emsisoft	Gen:Variant.Razy.613081 (B)
APEX	Malicious
Avira	HEUR/AGEN.1130188
Microsoft	VirTool:MSIL/Deimos.A!MTB
GData	Gen:Variant.Razy.613081
AhnLab-V3	Trojan/Win32.Occamy.C4011827
MAX	malware (ai score=80)
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:B7kXwtmdFoiwt1rJJDYAjg)
Fortinet	MSIL/Agent.RSW!tr
AVG	Win32:ExploitX-gen [Expl]
Cybereason	malicious.3a77be
Avast	Win32:ExploitX-gen [Expl]
MaxSecure	Trojan.Malware.300983.susgen

How to remove VirTool:MSIL/Deimos.A!MTB?

VirTool:MSIL/Deimos.A!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X