VirTool:Win32/VBInject!FP removal tips

The VirTool:Win32/VBInject!FP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/VBInject!FP virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Sandboxie through the presence of a library
• Code injection with CreateRemoteThread in a remote process
• Sniffs keystrokes
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• A process attempted to delay the analysis task by a long amount of time.
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• CAPE detected the CyberGate malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Attempts to modify proxy settings
• Creates a copy of itself
• Harvests cookies for information gathering
• Creates known SpyNet mutexes and/or registry changes.
• Anomalous binary characteristics

How to determine VirTool:Win32/VBInject!FP?

File Info:
name: 06F815D9DAC33DF7E581.mlw
path: /opt/CAPEv2/storage/binaries/e12198fd56716abc9ce09e5f59786221d108b990642453cf1c000e766c9cdd2d
crc32: 379E4D2A
md5: 06f815d9dac33df7e58140ff9afaf695
sha1: 1eeb49491498a347721e0618cbcea13e80fc3c9b
sha256: e12198fd56716abc9ce09e5f59786221d108b990642453cf1c000e766c9cdd2d
sha512: 1cbe6f488aa7a7cc62675064c2bc0b9bd311192f2519362f64c0d8c26d0f78a58c2705bafedffd0e32b573f37351188a8682e8b47002b59db1a11e06f1d37f07
ssdeep: 6144:HsdnZSf3FjeOd/Bv8jO2MrG6hbqplhJlHu31WXrdNWfUfVrJX0DuL4rejljKhTrF:MdnoRl/72MrG6elpWQRNFdmDuNat
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17C94CE6AB344F378E14484B0D52482FA519CEC79E489680BF7C23E5939F5AC2DA35BC7
sha3_384: e14ecd6ff90684de0ee01b41c46b5647d694138dff25027bad5078f5a6d3f7216c9ed76aa3c195a06d3966ba6fd299f7
ep_bytes: 68481a4000e8eeffffff000000000000
timestamp: 2011-04-12 01:06:12

Version Info:
0: [No Data]

VirTool:Win32/VBInject!FP also known as:

How to remove VirTool:Win32/VBInject!FP?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.