Should I remove “Win32/Injector.AWUQ”?

The Win32/Injector.AWUQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.AWUQ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Traditional)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics

How to determine Win32/Injector.AWUQ?

File Info:
name: 96663E267E68B5939AB6.mlw
path: /opt/CAPEv2/storage/binaries/131e6418d8db2281ed2e7d399a333089dfcaef566b62748baa5eeca19aacea82
crc32: 10DED8EE
md5: 96663e267e68b5939ab699ecbeb7e34a
sha1: 0ab8e0d3e2df5b23503fad067fcaabc7e1589bd6
sha256: 131e6418d8db2281ed2e7d399a333089dfcaef566b62748baa5eeca19aacea82
sha512: a2a30d6132e363d21b09784bf92c22549011357c9d86af94085b1006743af47f5840e46323143c6fd5b742361230699f17b491d62525f9f72c3b9b843f2ed98e
ssdeep: 6144:h98vaUNARKdww07LLqZA46PQEdGfmPaB7/WIvnksEVA14hYp9bY:0xNAC6aZuPDdbPGr1vklod0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15E54F164F389C429D138227FAFB88B80C495D2024890DAB8B5D62E167177B7B67B5F43
sha3_384: 8fc68a92a2b9ba94c95f05bd00a7edff787612918d5202fb48402130bc2a9c9390bc788aa64441f154ffe1a15b117dca
ep_bytes: 68c83c4400e8eeffffff000000000000
timestamp: 2014-01-23 15:50:43

Version Info:
Translation: 0x0404 0x04b0
Comments: Abbiocco Pomeridiano
CompanyName: RoseCitySoftware
ProductName: Araberhäuptlingen5
FileVersion: 2.05.0004
ProductVersion: 2.05.0004
InternalName: ggggggggggg
OriginalFilename: ggggggggggg.exe

Win32/Injector.AWUQ also known as:

How to remove Win32/Injector.AWUQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.