Win32/Injector.BDES removal instruction

The Win32/Injector.BDES is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.BDES virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Uses suspicious command line tools or Windows utilities

How to determine Win32/Injector.BDES?

File Info:
name: C4E911DC9C6B14246C4F.mlw
path: /opt/CAPEv2/storage/binaries/56b05c514b22d9e9a83d3bf750f4b8fe3b67d33a3e8adc56436a454e531317ae
crc32: F4C9F8CC
md5: c4e911dc9c6b14246c4fe8767c9ee617
sha1: 0ace579a4d44b1eb85740df6a0881595c9a22940
sha256: 56b05c514b22d9e9a83d3bf750f4b8fe3b67d33a3e8adc56436a454e531317ae
sha512: 57282c3894d0fbaa833c2dac0a0679be4d143247f8118756b9f643668a67c4b0d9a1822b38fde0afb9d000c74d1da20969c542f47e8610ddad913ee61b73cff2
ssdeep: 6144:R3+31PlbLNsv1i8HRussh95RBQsDLXHkUAmvi69uc5/K7/zLL98Gwy:dRv1iW5C5XQsfHkUAmqy/WLmy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B5B49D90E246DCE9E41572F19C2AD97011A7AD9EA8B00A2F317DB21D15B3363DCA3D1F
sha3_384: 8ed3253495cdffecdafcd899befc0be51a5ca730447f55eb2e7f2307df09172b5b440716fb3e22003b14015e929d6b7f
ep_bytes: 558bec6aff68286e400068de4a400064
timestamp: 2014-05-05 19:00:21

Version Info:
Comments: 
CompanyName:  
FileDescription: cluster
FileVersion: 1, 0, 0, 1
InternalName: cluster
LegalCopyright: Copyright ? 2014
LegalTrademarks: 
OriginalFilename: cluster.exe
PrivateBuild: 
ProductName:   cluster
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0810 0x04b0

Win32/Injector.BDES also known as:

How to remove Win32/Injector.BDES?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.