What is “NSIS/Injector.ABA”?

The NSIS/Injector.ABA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What NSIS/Injector.ABA virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine NSIS/Injector.ABA?


File Info:
crc32: 7302A0C4
md5: b9091ef41de734fdbd7c7df7b2a5ea20
name: B9091EF41DE734FDBD7C7DF7B2A5EA20.mlw
sha1: 4d313c6379933dfcfc79cab04a7c83899862b0d7
sha256: 3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac
sha512: f3aa29e6d4f77d36d1d6a0da1d88e69e69af9bed81a63b85869b1d2582a3e5ff121b9ac8a8b33e2d3f329569fcc3c5370b23da3bdca5636db91c9b6a98813733
ssdeep: 6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: Copyright ? 2018 FoldingBrowser 
FileVersion: 17
CompanyName: FoldingBrowser 
Comments: FoldingBrowser  v17 Installer
ProductName: FoldingBrowser  v17
FileDescription: FoldingBrowser  v17 Installer
Translation: 0x0409 0x0000

NSIS/Injector.ABA also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0052ed641 )
Lionic	Trojan.Win32.Generic.m!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Steam.2255
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.30904287
Cylance	Unsafe
Sangfor	Backdoor.Win32.Agent.gen
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Backdoor:Win32/Injector.8440bcc4
K7GW	Trojan ( 0052ed641 )
Cybereason	malicious.41de73
Symantec	Ransom.Rapid
ESET-NOD32	NSIS/Injector.ABA
APEX	Malicious
Avast	NSIS:CoinMiner-C [Trj]
ClamAV	Win.Dropper.Nemesis-6646739-0
Kaspersky	HEUR:Backdoor.Win32.Agent.gen
BitDefender	Trojan.GenericKD.30904287
NANO-Antivirus	Trojan.Win32.Steam.fgahap
MicroWorld-eScan	Trojan.GenericKD.30904287
Tencent	Win32.Backdoor.Agent.Pdvt
Ad-Aware	Trojan.GenericKD.30904287
Sophos	Mal/Generic-S
Comodo	Malware@#67un7mtu9tv8
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMAL3
McAfee-GW-Edition	BehavesLike.Win32.ObfusRansom.fc
FireEye	Generic.mg.b9091ef41de734fd
Emsisoft	Trojan.GenericKD.30904287 (B)
Avira	HEUR/AGEN.1127498
Microsoft	Trojan:Win32/Occamy.B
Gridinsoft	Trojan.Win32.Injector.sd!s5
Arcabit	Trojan.Generic.D1D78FDF
SUPERAntiSpyware	Trojan.Agent/Gen-Injector
GData	Trojan.GenericKD.30904287
McAfee	Artemis!B9091EF41DE7
MAX	malware (ai score=98)
VBA32	Backdoor.Agent
Panda	Trj/CI.A
TrendMicro-HouseCall	TSPY_HPLOKI.SMAL3
Fortinet	W32/Injector.XG!tr
AVG	NSIS:CoinMiner-C [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Miner.Coinminer.HyoDEpsA

How to remove NSIS/Injector.ABA?

NSIS/Injector.ABA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X