VirTool:Win32/Injector.BO removal guide

The VirTool:Win32/Injector.BO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/Injector.BO virus can do?

• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Attempts to modify proxy settings
• Harvests cookies for information gathering
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine VirTool:Win32/Injector.BO?

File Info:
name: 018D5067BCC1EF5A2943.mlw
path: /opt/CAPEv2/storage/binaries/1590c2a20679b17d749d9267b0e5c0a5993741dd1ac9d1f6109c9f91ea4d759a
crc32: 0087A2EE
md5: 018d5067bcc1ef5a29438d3b0123dd23
sha1: 1fe83564df4eee7197fd90792df08754d215516c
sha256: 1590c2a20679b17d749d9267b0e5c0a5993741dd1ac9d1f6109c9f91ea4d759a
sha512: 0dc5f116ec9d48f7d7f42a3ca9be5a4fbde923c3fec40c9befde65e8c28abd4f62ef03c30e1c9e7084b2f6232987d1df7f5c8f1f1e55c38854de6106a17f1950
ssdeep: 3072:FKPyF1ni06CVlUzlIqRN/Sz4N1V+d+hcTcRAAwDPsHa0Dqc3O9L4swY:FKPyFUC8z+qKzc1hvKFs605e40
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FC348C456FA2C561F01000B0AA56C7FA5A6D3C33AD92E21BF7D13F9D78706984D8AF63
sha3_384: 7569df42028e227e0682b815f1a928dfafe7e82bac12d45af2d765de463bcfe073b9c59f6b61cf0af4ebe09f7d3c1d7f
ep_bytes: 558bec6aff68f890400068e086400064
timestamp: 2012-02-17 11:58:39

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft (R) Address Book Import Tool
FileVersion: 6.00.2900.5512 (xpsp.080413-2105)
InternalName: WABMIG.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WABMIG.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.2900.5512
Translation: 0x0409 0x04b0

VirTool:Win32/Injector.BO also known as:

How to remove VirTool:Win32/Injector.BO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.