Backdoor:MSIL/Makadocs.JG is a .NET-based backdoor trojan designed to give attackers persistent remote access to infected Windows systems. Once established, this malware operates silently in the background, opening a communication channel that allows cybercriminals to execute commands, download additional payloads, and exfiltrate sensitive data without the victim's knowledge. The "Makadocs" family has been in circulation since the early 2020s, targeting both individual users and small business networks through phishing campaigns and software bundling.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Backdoor:MSIL/Makadocs (multiple variants) |
| Common Aliases | MSIL/Makadocs.JG, Trojan.Makadocs, BackDoor.MSIL.Maker, Generic.Makadocs |
| Platform | Windows (all versions with .NET Framework 4.0+) |
| First Documented | 2020 (JG variant emerged ~2021) |
| Distribution Methods | Phishing attachments, fake software installers, torrent bundles, exploit kits |
| Persistence Mechanism | Registry Run keys, scheduled tasks, COM object hijacking |
| Primary Capabilities | Remote command execution, file upload/download, keylogging module loading, screenshot capture, credential theft preparation |
| Typical File Locations | %APPDATA%\[random folder], %LOCALAPPDATA%\[GUID], %TEMP%\[8-char random] |
| Network Behavior | Outbound connections to command-and-control servers on non-standard ports; beacon intervals vary (60-300 seconds typical) |
| Common IoCs | Registry entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run; scheduled tasks named with alphanumeric strings; mutexes matching pattern "MD_[A-F0-9]{8}" |
| Data at Risk | Browser stored credentials, cryptocurrency wallets, FTP clients, email credentials, system information |
| Removal Difficulty | Moderate—uses obfuscation and may reinstall itself if persistence mechanisms aren't fully cleared |
How It Spreads
Backdoor:MSIL/Makadocs.JG reaches victims primarily through social engineering tactics that exploit trust and urgency. The most common infection vector involves email attachments disguised as invoices, shipping notifications, or document scans. These emails often appear to come from legitimate businesses or shipping companies, with the attachment being a ZIP archive containing the malicious executable or a Microsoft Office document with malicious macros that download the backdoor.
Software piracy and unofficial download sites represent another significant distribution channel. Attackers bundle this backdoor with cracked applications, key generators, and game cheats. Users searching for free versions of paid software may download what appears to be a working installer but actually contains the backdoor alongside (or instead of) the promised application. Torrent sites and file-sharing platforms are particularly rife with these trojanized packages.
The Makadocs family also spreads through:
- Malicious advertising (malvertising) on legitimate websites that redirects to exploit kit landing pages
- Fake software updates for browsers, Flash Player (even after its discontinuation), or media codecs
- Compromised downloads from legitimate-looking but actually malicious software repositories
- Secondary payload delivery from existing infections—other malware downloading Makadocs as an additional module
- USB drive propagation in some variants that copy themselves to removable media with autorun configurations
- Remote Desktop Protocol (RDP) brute-force attacks on poorly secured business systems, after which attackers manually install the backdoor
What It Does On Your Machine
Once executed, Backdoor:MSIL/Makadocs.JG immediately begins establishing persistence to survive system reboots. Being written in .NET (MSIL stands for Microsoft Intermediate Language), the malware can be easily obfuscated and modified, making signature-based detection challenging. The backdoor typically copies itself to a hidden folder in the user's AppData directory with a randomized filename designed to blend in with legitimate system processes—names like "svchost32.exe" or "updateservice.exe" are common disguises.
The malware creates multiple persistence points to ensure it restarts even if one mechanism is removed. Registry Run keys are the most common approach, but scheduled tasks set to trigger at user logon provide redundancy. Some variants also modify existing scheduled tasks or create COM object hijacks that cause the backdoor to load whenever certain legitimate Windows components are accessed. This multi-layered persistence makes casual removal attempts ineffective.
After establishing itself, the backdoor contacts its command-and-control (C&C) server to announce the new infection and await instructions. This communication often occurs over non-standard ports and may use encryption to evade network monitoring. The C&C connection transforms your computer into a remotely controllable asset. Attackers can execute arbitrary commands with your user privileges, upload and download files, take screenshots, enumerate installed software, and deploy additional malware modules—all without your knowledge.
The information-stealing capabilities of this backdoor family are particularly concerning for both home users and businesses. While the core backdoor itself focuses on maintaining access and command execution, attackers routinely use it to deploy specialized credential-theft modules. These can harvest saved passwords from browsers, extract email credentials from Outlook and Thunderbird, locate cryptocurrency wallet files, and capture FTP credentials from FileZilla and other clients. For small businesses, this can mean complete compromise of accounting systems, customer databases, and business email accounts.
Manual Removal — Step by Step
Disconnect From the Internet
Immediately disable your network connection—unplug the Ethernet cable or turn off Wi-Fi. This breaks the backdoor's connection to its command server and prevents it from receiving commands to download additional payloads or wipe evidence. Keep the system offline throughout the entire removal process.
Boot Into Safe Mode With Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) repeatedly during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking." This loads Windows with minimal drivers and prevents most malware from launching automatically, though you'll still have network capability for downloading tools if needed (use your phone's hotspot, not your main network).
Identify and Terminate the Backdoor Process
Open Task Manager (Ctrl+Shift+Esc) and look for suspicious processes in the Details tab. Makadocs variants often disguise themselves with names similar to legitimate Windows services but with slight misspellings or incorrect locations. Right-click any suspicious process, select "Open file location," and if it leads to AppData folders or Temp directories, terminate it. Note the file path for later deletion.
Remove Registry Persistence Entries
Press Win+R, type "regedit," and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and look for entries pointing to executables in AppData or Temp folders with suspicious names. Delete any entries you identified in the previous step. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for system-wide entries. Export the registry before making changes as a precaution.
Delete Scheduled Tasks
Open Task Scheduler (search for it in the Start menu) and examine the Task Scheduler Library. Look for recently created tasks with generic names like "SystemMaintenance" or random alphanumeric strings that run executables from AppData directories. Right-click and delete any suspicious tasks. Pay special attention to tasks set to run at user logon or with unusual trigger conditions.
Delete the Malware Files and Folders
Using File Explorer with hidden files visible (View tab → Options → View → "Show hidden files, folders, and drives"), navigate to the folders you identified earlier (typically in %APPDATA% or %LOCALAPPDATA%). Delete the entire malware folder. Then check %TEMP% and delete any suspicious recent files with random names. Empty the Recycle Bin afterward to prevent accidental restoration.
Run a Comprehensive Malware Scan
Download and install Malwarebytes Free (using a different, clean computer if possible, transferring via USB). Update its definitions and run a full "Threat Scan." This will catch any components you missed and detect any secondary payloads the backdoor may have downloaded. Quarantine and remove everything it finds. Consider following up with a second scan using HitmanPro or Microsoft Defender Offline for additional verification.
Check and Reset Browser Settings
Some Makadocs variants modify browser settings to facilitate credential theft or install malicious extensions. Open each browser you use, check installed extensions for anything unfamiliar, and remove suspicious items. Reset your browser settings to defaults if you notice changed homepages or search engines. Clear all browsing data including cached images and cookies.
Change All Critical Passwords
From a known-clean device (not the infected computer), immediately change passwords for email accounts, banking, social media, and any work-related systems. Enable two-factor authentication wherever possible. Assume that any credentials stored on the infected machine were compromised. For business systems, notify your IT administrator or security team about the potential breach.
Reboot and Verify Clean Status
Restart the computer normally (not in Safe Mode) and immediately run another full scan with your anti-malware software. Check Task Manager for any return of suspicious processes. Monitor your network connections using Resource Monitor (resmon.exe) for unexpected outbound traffic. If everything appears clean after 24 hours of normal use with no redetection, the removal was likely successful.
Prevention
- Never open email attachments from unexpected sources. Even if an email appears to come from a legitimate company, verify through a separate channel (call them directly, don't use contact info in the email) before opening attachments, especially ZIP files or Office documents requesting you to "enable macros."
- Download software only from official sources. Avoid torrent sites, "crack" repositories, and unofficial download mirrors entirely. If you need free alternatives to paid software, research legitimate open-source options rather than pirated versions that come bundled with malware.
- Keep Windows and all software updated. Enable automatic updates for Windows, browsers, and commonly targeted applications like Adobe Reader and Java. Many backdoor infections exploit known vulnerabilities that patches have already fixed—staying current closes these doors.
- Use and maintain reputable security software. Install a quality antivirus solution (Windows Defender is adequate if kept updated; Malwarebytes Premium or Bitdefender offer stronger protection) and ensure real-time protection is active. Don't disable it "temporarily" to install software—that's exactly when you're most vulnerable.
- Enable a firewall and review outbound connections. Windows Firewall should always be active. For additional protection, consider a firewall that alerts you to new outbound connections, allowing you to catch malware "phoning home" to its command server before it can receive instructions.
- Practice the principle of least privilege. Don't use an administrator account for daily tasks. Create a standard user account for regular work and browsing. This limits malware's ability to make system-wide changes and install persistent components that affect all users.
- Back up important data regularly to offline storage. Maintain backups on external drives that are disconnected when not in use, or use cloud backup services with versioning. This won't prevent infection, but it protects you from data loss if malware damages files or if you need to perform a complete system wipe and reinstall.
- Be skeptical of urgent messages and too-good-to-be-true offers. Cybercriminals rely on emotional manipulation—urgency ("Your account will be locked!"), fear ("IRS investigation"), and greed ("Free premium software!"). Slow down, think critically, and verify independently before clicking or downloading anything.
When Computer Repair Roswell removes malware from your system, we guarantee our work for 90 days. If the same infection returns within that period due to remnants we missed (not from re-infection through unsafe browsing), we'll clean it again at no additional charge. We stand behind our expertise.
Bring It In
Backdoor infections like Makadocs.JG are serious business. While the manual removal steps above can work, they require technical confidence and thoroughness—missing even one persistence mechanism means the malware comes right back. Worse, you can't be certain what additional payloads it downloaded before you caught it, or what data it already transmitted to attackers. For businesses, there's also the compliance question: if customer data may have been exposed, you need documentation of professional remediation.
Computer Repair Roswell has been cleaning infected systems for Roswell-area residents and businesses since 2002. We use professional-grade forensic tools to identify every component of an infection, remove it completely, and verify the system is clean. We'll also help you understand how it happened and implement practical defenses to prevent reinfection. Our shop is located right here in Roswell—stop by or call (770) 415-0396 to schedule a diagnostic. Same-day service is often available, and we'll give you an honest assessment before we do any work. Don't let a backdoor turn your computer into someone else's remote-controlled asset.