Win32/Injector.Autoit.FBU removal instruction

The Win32/Injector.Autoit.FBU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.Autoit.FBU virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
A scripting utility was executed
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

BRHlEL.BRHlEL

How to determine Win32/Injector.Autoit.FBU?


File Info:
crc32: 7FB5F2BF
md5: 5c8f76ef10a7d2493dec6399c4225a73
name: upload_file
sha1: f40891e66c3b6a568a822a6a09868370ea80a3a1
sha256: 637d172395f876a73f77476c2ab1261e289b8f12395110627a7c93583b11c868
sha512: b244a4e76d4fa9b73008bac323443f0c26e9a6053550c0b7ae174b7434ae4a28f9d2982995ec999c91cfd3945f0a248ee4c95dfd21b20569a8b0bca361f31f0c
ssdeep: 24576:YQEhMzeNJBjAObi4M2rIDTU4fmj6J/d5JJXuE6YBp5:YQEhM8BfbiyrIDovj6llJXv6YB
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Lorem Thousands Blind Long
InternalName: Lorem Thousands Blind Long
FileVersion: 53.81.94
CompanyName: Lorem Thousands Blind Long
LegalTrademarks: Lorem Thousands Blind Long
Comments: Lorem Thousands Blind Long
ProductName: Lorem Thousands Blind Long
ProductVersion: 53.81.94
FileDescription: Lorem Thousands Blind Long
OriginalFilename: Lorem Thousands Blind Long.exe
Translation: 0x0409 0x04b0

Win32/Injector.Autoit.FBU also known as:

MicroWorld-eScan	Trojan.GenericKD.34265706
FireEye	Generic.mg.5c8f76ef10a7d249
Qihoo-360	Generic/Trojan.55f
McAfee	Artemis!5C8F76EF10A7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.BAT.Generic.4!c
K7AntiVirus	Trojan ( 00562f171 )
BitDefender	Trojan.GenericKD.34265706
K7GW	Trojan ( 00562f171 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
GData	Trojan.GenericKD.34265706
Kaspersky	HEUR:Trojan.BAT.Generic
Alibaba	Trojan:Win32/Injector.dff6d7fc
ViRobot	Trojan.Win32.Z.Autoit.1053104
Ad-Aware	Trojan.GenericKD.34265706
Emsisoft	Trojan.GenericKD.34265706 (B)
F-Secure	Trojan.TR/AutoIt.pgzgo
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	TR/AutoIt.pgzgo
MAX	malware (ai score=84)
Arcabit	Trojan.Generic.D20ADA6A
ZoneAlarm	HEUR:Trojan.BAT.Generic
Microsoft	Trojan:Win32/Casdet!rfn
Cynet	Malicious (score: 85)
ALYac	Trojan.GenericKD.34265706
Malwarebytes	Trojan.Injector
ESET-NOD32	Win32/Injector.Autoit.FBU
SentinelOne	DFI – Malicious PE
eGambit	PE.Heur.InvalidSig
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Win32/Injector.Autoit.FBU?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Injector.Autoit.FBU removal instruction