NSIS/Injector.CMO removal guide

The NSIS/Injector.CMO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What NSIS/Injector.CMO virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• A scripting utility was executed
• CAPE detected the shellcode get eip malware family
• A script or command line contains a long continuous string indicative of obfuscation
• Attempts to execute suspicious powershell command arguments
• Yara detections observed in process dumps, payloads or dropped files

How to determine NSIS/Injector.CMO?

File Info:
name: 65776D668BF11116DD97.mlw
path: /opt/CAPEv2/storage/binaries/0a53c3881a3fa2a2219dacf69df133a66250063ffee9cc35bfe1e56759286682
crc32: EEB2E27F
md5: 65776d668bf11116dd97b54c1c280fd5
sha1: 512cb011ee03041f66456e052a39a4062113f6a7
sha256: 0a53c3881a3fa2a2219dacf69df133a66250063ffee9cc35bfe1e56759286682
sha512: 5e1e771596ed2f8e3737db2c349b45924def9ee0ba84865017abb2a4e1c3569f98c5526ed2781ee8361f1a7d0da2fa8c30cc4e757bb0b2519d542c06c830977c
ssdeep: 24576:8IGB3Fr2WJfxpzXTuvMJbmhQU/YydIE5Ltp:ExZjuvMxmhB/Ylyp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EF25230C3A4AD0FAF60283396769FB07498A59072642361777B1F2B55B72783DE5F8C8
sha3_384: d3e5df5c393bb9b515eacf5ac46a50d758fb428aa158ae7ee44257452b2b97a18a83cc29e910dd14c6270d13981edd2a
ep_bytes: 81ecd40200005356576a205f33db6801
timestamp: 2016-07-25 00:55:57

Version Info:
CompanyName: keratinoid myall knaldrde
FileDescription: choroiditis resole undeceives
InternalName: hyperenthusiastically rdkridtet.exe
LegalCopyright: brydetags troparia
OriginalFilename: hyperenthusiastically rdkridtet.exe
Translation: 0x0409 0x04e4

NSIS/Injector.CMO also known as:

How to remove NSIS/Injector.CMO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.