Trojan.Fileless.MTGen
Short bio
Trojan.Fileless.MTGen is Malwarebytes’ generic detection name for the startup locations in use by fileless infections that gain persistence by creating these registry keys on Windows systems.
Symptoms
In the majority of the cases, the registry keys created by Trojan.Fileless.MTGen are designed to run Powershell commands that carry out the rest of the infection. Other than Powershell, we have also seen the mshta command used as such.
Protection
Malwarebytes protects users from Trojan.Fileless.MTGen by using real-time protection to block the Trojans that create them.
Malwarebytes prevents Trojan.Fileless.MTGen
Remediation
Malwarebytes can detect and remove Trojan.Fileless.MTGen without further user interaction.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that All Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
Some of these Trojans are very difficult to remove or keep coming back. Make sure that the scan for rootkits in Malwarebytes is enabled under “Scan options” on the “Protection” tab.
