VirTool:Win32/VBInject.AIH!bit removal guide

The VirTool:Win32/VBInject.AIH!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:Win32/VBInject.AIH!bit virus can do?

Executable code extraction
Creates RWX memory
Anomalous binary characteristics

How to determine VirTool:Win32/VBInject.AIH!bit?


File Info:
crc32: 6FA3E02F
md5: 736d043be99947fd6c2aa5753fc52f84
name: 736D043BE99947FD6C2AA5753FC52F84.mlw
sha1: 0bf2cc3071c466fcb68b20e4e2cb2eaa6d47dc1e
sha256: 212b53fe6ac21afa1c6ea75085d2c0a51d908f4c36934cb97b647bcbddc01377
sha512: 4e5cf1fa733546a54a1ffa86fc97f285405560bed905c9e8b3a894f3e1bd4d91eb90ca42ba82ec122c27faba82d87d65b28d8255c5bb33a8bcb42a777f560992
ssdeep: 6144:RjdtnwajYcW7uRhfY3MtsMbkJS/XtbhdmGrjLJPsl:tdlWMFVtsMb2qXtbhdmGrful
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: HP, iNc. 
InternalName: CHAMPIONATzekfinansgiganttermi
FileVersion: 1.00
CompanyName: nIji 
LegalTrademarks: siTCOin project 
ProductName: yAhOo, iNc. 
ProductVersion: 1.00
FileDescription: pIRiform lTd 
OriginalFilename: CHAMPIONATzekfinansgiganttermi.exe

VirTool:Win32/VBInject.AIH!bit also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 00542def1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.25089
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.PonyStealer.um0@iWjSv3gi
Cylance	Unsafe
Sangfor	Trojan.Win32.Coins.nwz
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanPSW:Win32/Coins.c062f3e4
K7GW	Trojan ( 00542def1 )
Cybereason	malicious.be9994
Cyren	W32/VBInject.NL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EBXZ
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Trojan.Gamarue-9651698-0
Kaspersky	Trojan-PSW.Win32.Coins.nwz
BitDefender	Gen:Heur.PonyStealer.um0@iWjSv3gi
NANO-Antivirus	Trojan.Win32.Coins.fkraks
MicroWorld-eScan	Gen:Heur.PonyStealer.um0@iWjSv3gi
Tencent	Win32.Trojan-qqpass.Qqrob.Agbl
Ad-Aware	Gen:Heur.PonyStealer.um0@iWjSv3gi
Sophos	Mal/Generic-S + Troj/Zbot-MUT
Comodo	Malware@#2g8fnwd5ol5xh
BitDefenderTheta	Gen:NN.ZevbaF.34294.um0@aWjSv3gi
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THABBFAH
McAfee-GW-Edition	Fareit-FMP!736D043BE999
FireEye	Generic.mg.736d043be99947fd
Emsisoft	Gen:Heur.PonyStealer.um0@iWjSv3gi (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Dropper.VB.dpek
eGambit	Unsafe.AI_Score_86%
Antiy-AVL	Trojan/Generic.ASMalwS.2996C53
Microsoft	VirTool:Win32/VBInject.AIH!bit
Arcabit	Trojan.PonyStealer.EE857A
GData	Gen:Heur.PonyStealer.um0@iWjSv3gi
AhnLab-V3	Trojan/Win32.Injector.C2863818
Acronis	suspicious
McAfee	Fareit-FMP!736D043BE999
MAX	malware (ai score=87)
Malwarebytes	Trojan.MalPack.VB
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.MALREP.THABBFAH
Yandex	Trojan.PWS.Coins!hkcuN+WJYm0
Ikarus	Trojan.VB.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.CTYB!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml

How to remove VirTool:Win32/VBInject.AIH!bit?

VirTool:Win32/VBInject.AIH!bit removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X