What is “VirTool:Win32/AutInject!pz”?

The VirTool:Win32/AutInject!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/AutInject!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the NanoCore malware family
• Deletes executed files from disk
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine VirTool:Win32/AutInject!pz?

File Info:
name: 696DC174FDAA2C9165FD.mlw
path: /opt/CAPEv2/storage/binaries/a79b267b1023ec73ca1123f0576afe6af9f2cbd365f725fc5bce004d22165ada
crc32: 16D07910
md5: 696dc174fdaa2c9165fdc7e7837ca8b7
sha1: 122225f353572b882f31a4d911c0394e39199aef
sha256: a79b267b1023ec73ca1123f0576afe6af9f2cbd365f725fc5bce004d22165ada
sha512: ac80f5d1441092f54655db801934625ae68858a1b604d0d7c08d8c4a4e4c428016f36489d2f1b04f380ad6d9a83afd2b78c8b46ede5ca06d0b21584bfcd16c02
ssdeep: 24576:XAHnh+eWsN3skA4RV1Hom2KXMmHatoI3fr6j2/2+n/a55g:Kh+ZkldoPK8YatoMYe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C955BF42B395C0B2FE57A2B39F15B6865B7C69350133802F23982DA9BD725B1423DB73
sha3_384: b42cc2dba55dad71a701148c14f7f1122e7226b24c35a9e5b6b061dc07cc4c8b90392845cc9f34caf947a3d38ea25be0
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-04-15 12:59:00

Version Info:
Translation: 0x0809 0x04b0

VirTool:Win32/AutInject!pz also known as:

How to remove VirTool:Win32/AutInject!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.