Win32/Injector.ANFF removal tips

The Win32/Injector.ANFF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Injector.ANFF virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Injector.ANFF?


File Info:
name: 276A811C5DE74DE3417E.mlw
path: /opt/CAPEv2/storage/binaries/a32304ba74a81b7c4cbaca99aef2ea40c359f47f86b5c430ae21175a32d16452
crc32: A0027C74
md5: 276a811c5de74de3417e904d886583f7
sha1: 424264284d9f5be569deaf3f4fa0dd586b0f6fdf
sha256: a32304ba74a81b7c4cbaca99aef2ea40c359f47f86b5c430ae21175a32d16452
sha512: c0dac8e15b322401d7caca6c83ecc8de2b7b2107ca79a47277448182725618e10fe5071b571b148019920cc1af81593f9a866beb42e7b0ad896919b0901c14ad
ssdeep: 3072:p5ekcskbvq+dBb8CsWp9wxhr5xhjfvR1ZfCPibFAx4odh568pIxN2s34:pAkjkqqspHzhjEPibFW9xOxE64
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BB24E067E6914273D0209BBCDC3B9820D22B7C767934946A2BBD3E4B0E792E64C5D317
sha3_384: 104171aceba600456140cafd216865310a86bf280155ad4e5e3c38b34434f4287e6794c13b36eee62909b1116e74379a
ep_bytes: e5171a0b2ccc4386a4002aed661dedf3
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Win32/Injector.ANFF also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.283
MicroWorld-eScan	Trojan.GenericKD.34626661
FireEye	Generic.mg.276a811c5de74de3
McAfee	Artemis!276A811C5DE7
Malwarebytes	Malware.Heuristic.1003
Sangfor	Trojan.Win32.Wacatac.DA
Alibaba	Trojan:Win32/Injector.b05bac92
Cybereason	malicious.c5de74
Arcabit	Trojan.Generic.D2105C65
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Injector.ANFF
Paloalto	generic.ml
ClamAV	Win.Dropper.Dircrypt-9758043-0
BitDefender	Trojan.GenericKD.34626661
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Delf-TTA [Trj]
Rising	Trojan.Generic@AI.100 (RDML:mHj7+SM33aEwjcFEVy1Alg)
Ad-Aware	Trojan.GenericKD.34626661
Sophos	ML/PE-A + Mal/Dampatch-A
McAfee-GW-Edition	BehavesLike.Win32.Playtech.dc
SentinelOne	Static AI – Malicious PE
Emsisoft	Trojan.GenericKD.34626661 (B)
Ikarus	Trojan-Ransom.Mbro
Avira	TR/Dropper.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.34626661
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Banload.C120045
Acronis	suspicious
VBA32	Trojan.Encoder
ALYac	Trojan.GenericKD.34626661
TACHYON	Trojan/W32.Banload.226446
APEX	Malicious
Tencent	Malware.Win32.Gencirc.11afc1e7
Yandex	Trojan.GenAsa!DVOT7J7g604
MAX	malware (ai score=84)
MaxSecure	Trojan.Malware.7175209.susgen
Fortinet	W32/Kryptik.HGEO!tr
AVG	Win32:Delf-TTA [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32/Injector.ANFF?

Win32/Injector.ANFF removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X