How to remove “Win32/Injector.AVOJ”?

The Win32/Injector.AVOJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.AVOJ virus can do?

• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Collects and encrypts information about the computer likely to send to C2 server
• Creates a hidden or system file
• Collects information to fingerprint the system

How to determine Win32/Injector.AVOJ?

File Info:
name: F3D7CE1DA2651EA0C4FA.mlw
path: /opt/CAPEv2/storage/binaries/6019fe188607e60646df898d2b13735c7b6e49c9ece15a8ac082897af8077bcd
crc32: 0CC95D3C
md5: f3d7ce1da2651ea0c4fa5393153ea762
sha1: b79a2b610ac4bce4663415333b2a3dc452a58d99
sha256: 6019fe188607e60646df898d2b13735c7b6e49c9ece15a8ac082897af8077bcd
sha512: 531e66a503bb301b340e8da75fa2052c868e9f5a450b755e89ef4d70775d3d6d4e277b7563a45db08388b9b72dbc07f50cfc69243b93613dfea0a8b78cddb005
ssdeep: 6144:RSh/C9ArDlkv6j3qdcnoJnOq6RsOfyQiRWRj5OTi9g+oOiIFsy+Rx:RLskvQo57OfJi822QOiIF8Rx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1956402AAAB8D4CC3FDDA5C313467B1041225BDE52A6759D78D281C488F70E830EF5BAD
sha3_384: 6c65b8c3a77603e1986930d5a6c2c410be99964cbc5d7ad843090ce1d2fcfc95ca140e73ff180a832c85a960aa5561b1
ep_bytes: 5657ff15a0a040008b359ca04000ffd6
timestamp: 2014-01-14 06:46:54

Version Info:
FileDescription: WndRexUI
FileVersion: 1.6.5.7
InternalName: WndRexUI
LegalCopyright: Copyright © 1999-2014
ProductVersion: 1.6.5.7
Translation: 0x0409 0x04b0

Win32/Injector.AVOJ also known as:

How to remove Win32/Injector.AVOJ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.