How to remove “Trojan:Win64/CryptInject!MSR”?

The Trojan:Win64/CryptInject!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win64/CryptInject!MSR virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Creates a copy of itself

How to determine Trojan:Win64/CryptInject!MSR?

File Info:
name: 7A0A3E5189F78565B48C.mlw
path: /opt/CAPEv2/storage/binaries/1526fc970cdb0e5a69f0ca2284d12312c6f7c9d0e77aa264aa4260411a4f03e7
crc32: 7092CF83
md5: 7a0a3e5189f78565b48c36ca226f223a
sha1: e8d485259e64fd375e03844c03775eda40862e1c
sha256: 1526fc970cdb0e5a69f0ca2284d12312c6f7c9d0e77aa264aa4260411a4f03e7
sha512: f92d3deca17a2aeeece09b20ada894583edac58e9118634bf9ea71d59e22fe4c767f1d0e2d752a132a7f0b1bf63ec2fdccc2e8ee16b8bc1aedb721f668052c1c
ssdeep: 24576:paTyE7n9Q6PCG/aZNJWHYV2f0aQqOz068eV97TU/DUXwu7mjUd0UZIa1HC7aA1md:y79QSChOMhqOz06xEG7mwVc1mOaH
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1A1951282984594E8D3F2A23A062D63737DA2F4009E674BEB33D38115A7785653BEFC47
sha3_384: 34cf390b2cffa98d8a3a510bd301b3d3a97f02283041f8060e98e4f22aa538f6ae93cd770494e133fa4116c85b18c249
ep_bytes: 4883ec38c70542641d0000000000ba06
timestamp: 2021-04-04 01:25:28

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows SQM Consolidator
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName: wsqmcons.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: wsqmcons.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7601.17514
Translation: 0x0409 0x04b0

Trojan:Win64/CryptInject!MSR also known as:

How to remove Trojan:Win64/CryptInject!MSR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.