What to verify before removal
Trojan:Win32/CryptInject.BZ!MTB removal should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.
Start by comparing the local file name with starticon1.exe, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.
- Observed file
- starticon1.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- MD5
- 177a8406b5e1efdd8f79ece92f2b4825
- Compare the suspicious file name with starticon1.exe.
- Confirm the detection name matches Trojan:Win32/CryptInject.BZ!MTB removal before removing related files.
- Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
- Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.
- Use the MD5 value 177a8406b5e1efdd8f79ece92f2b4825 only as a quick comparison point; prefer SHA-256 when available.
The Trojan:Win32/CryptInject.BZ!MTB file is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.
What Trojan:Win32/CryptInject.BZ!MTB virus can do?
- Freezing computer.
- New home page in browsers.
- Ads and pop-ups on desktop and browser.
- Very slow loading speed of webpages.
- Computer work slower then usual.
How to determine Trojan:Win32/CryptInject.BZ!MTB?
General:
Operating System: Windows 7 / 8 / 8.1 / 10 Virus Name: HEUR:Trojan.Win32.Agent.gen
File Info:
Name: starticon1.exe
Size: 724480
Type: PE32 executable (GUI) Intel 80386, for MS Windows
MD5: 177a8406b5e1efdd8f79ece92f2b4825
SHA1: c83602dfae92dd47e00c8d43bb14ec798ef71cbf
SH256: 2e44467717c1b09314bd7193af70683f20b0c5740f45fadbe28d5eff38690cfd
Version Info:
[No Data]
Trojan:Win32/CryptInject.BZ!MTB also known as:
| ALYac | Trojan.Ransom.Stop |
| APEX | Malicious |
| AVG | Win32:CrypterX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.32672149 |
| AegisLab | Trojan.Win32.Zbot.m6l9 |
| AhnLab-V3 | Trojan/Win32.MalPe.R295858 |
| Alibaba | Trojan:Win32/CryptInject.cdb2e18d |
| Antiy-AVL | Trojan/Win32.Wacatac |
| Arcabit | Trojan.Generic.D1F28995 |
| Avast | Win32:CrypterX-gen [Trj] |
| Avira | TR/Crypt.Agent.kowki |
| BitDefender | Trojan.GenericKD.32672149 |
| BitDefenderTheta | Gen:Trojan.Heur2.PPBB.3.0.SuW@d0soCTda0d |
| CAT-QuickHeal | Trojan.Bomitag |
| ClamAV | Win.Malware.Generic-7366725-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.6b5e1e |
| Cylance | Unsafe |
| Cyren | W32/Trojan.BNUE-1812 |
| DrWeb | Trojan.Encoder.26996 |
| ESET-NOD32 | a variant of Win32/Kryptik.GXPO |
| Emsisoft | Trojan.GenericKDZ.58908 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Kryptik.API.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.Agent.kowki |
| FireEye | Generic.mg.177a8406b5e1efdd |
| Fortinet | W32/Kryptik.GXPO!tr |
| GData | Trojan.GenericKD.32672149 |
| Ikarus | Trojan.Inject |
| Invincea | heuristic |
| Jiangmin | Trojan.Chapak.hkk |
| K7AntiVirus | Trojan ( 0055a3e91 ) |
| K7GW | Trojan ( 0055a3e91 ) |
| Kaspersky | HEUR:Trojan.Win32.Agent.gen |
| MAX | malware (ai score=100) |
| Malwarebytes | Trojan.MalPack.GS |
| McAfee | RDN/Generic.grp |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.bc |
| MicroWorld-eScan | Trojan.GenericKD.32672149 |
| Microsoft | Trojan:Win32/CryptInject.BZ!MTB |
| NANO-Antivirus | Trojan.Win32.Kryptik.gekgpo |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Qihoo-360 | HEUR/QVM10.2.C346.Malware.Gen |
| Rising | Trojan.Kryptik!1.BE74 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Crypt |
| SentinelOne | DFI – Suspicious PE |
| Sophos | Mal/GandCrab-G |
| Symantec | Trojan.Gen.2 |
| TACHYON | Ransom/W32.Stop.724480.B |
| TrendMicro | TROJ_GEN.R03FC0PJR19 |
| TrendMicro-HouseCall | Trojan.Win32.SMOKELOAD.SMD.hp |
| VBA32 | Trojan.Wacatac |
| VIPRE | Trojan.Win32.Generic!BT |
| ViRobot | Trojan.Win32.Z.Wacatac.724480 |
| Webroot | W32.Trojan.Gen |
| Zillya | Trojan.Kryptik.Win32.1799804 |
| ZoneAlarm | HEUR:Trojan.Win32.Agent.gen |
How to remove Trojan:Win32/CryptInject.BZ!MTB?
- Download and install GridinSoft Anti-Malware.
- Open GridinSoft Anti-Malware and perform a “Standard scan“.
- “Move to quarantine” all items.
- Open “Tools” tab – Press “Reset Browser Settings“.
- Select proper browser and options – Click “Reset”.
- Restart your computer.