About “Trojan:Win32/Aenjaris!pz” infection

The Trojan:Win32/Aenjaris!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Aenjaris!pz virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Deletes executed files from disk
• Anomalous binary characteristics

How to determine Trojan:Win32/Aenjaris!pz?

File Info:
name: E8C1F4877B00100F10FF.mlw
path: /opt/CAPEv2/storage/binaries/c1a072375fbe253550953c6248fc4046636a36daaae6678774d6e1cc2603c8fc
crc32: 0C211775
md5: e8c1f4877b00100f10ff793035faa955
sha1: 80063199fee75e29f0b91226f860ed734b85d24a
sha256: c1a072375fbe253550953c6248fc4046636a36daaae6678774d6e1cc2603c8fc
sha512: e1549e882eb6e4ded0692b6a7f7824ba403958054310a5cbfacffa6c3e2c3af42dd6db23240173d00930442904cf1f1e6fc2098a79ee12ab896e03ba9aab03d3
ssdeep: 6144:hwDXrJ1ryPClC+Vog84LkEjiPISUOgW9X+hOGzC/NM:hSd1ryPgFag8wkmZzcukG2/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T166A48D54B9999763E3630334689BF6A4573ABC60F367821B3058F32C31B3B60197A76D
sha3_384: d2424721b8c93c7141846bc47fb083270f2d4b9448c25f13cc337be9e62eaa5ec39117a0a106d0ce7e1d6349ac540826
ep_bytes: 60bf000000008aa700104000c0c48fc0
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

Trojan:Win32/Aenjaris!pz also known as:

How to remove Trojan:Win32/Aenjaris!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.