Categories: Malware

Win32/Injector.DMAX removal guide

The Win32/Injector.DMAX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DMAX virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Compression (or decompression)
Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
Executed a process and injected code into it, probably while unpacking
Network activity detected but not expressed in API logs
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

redirector.gvt1.com

r8—sn-bpb5oxu-3c2r.gvt1.com

update.googleapis.com

How to determine Win32/Injector.DMAX?


File Info:
crc32: EE3868BDmd5: fa4e91f478cb00f8bb6f98d4fc00503aname: FA4E91F478CB00F8BB6F98D4FC00503A.mlwsha1: 7e57e488f6ea25842cb5a5723bae21304d299e1esha256: aa4a0dde592488e88143028acdb8f035eb0453f265efeeebba316a6afe3e2b73sha512: 4af743de9402321eb35cefe541c49ef92e3a49e633813d4e1078253fd13f6b8311f6f1278ee6f5e267869df2af5c3cc653bb219dd0ce141d5aa84e1c958be425ssdeep: 6144:WMMYNXqBBRWQw7j8iddXKZx0z8bTYZ2xus/tdqHllu4eDGJJVeq00SSlY:6nRWVj8sBMxk8IZUOlu4eDGJJIPSlYtype: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Version Info:
0: [No Data]

Win32/Injector.DMAX also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 0050780c1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.761
Cynet	Malicious (score: 99)
ALYac	Trojan.Ransom.cryptolocker
Sangfor	Trojan.Win32.Generic.5
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 0050780c1 )
Cybereason	malicious.478cb0
Cyren	W32/Trojan.VBCE-1912
Symantec	Ransom.TorrentLocker
ESET-NOD32	a variant of Win32/Injector.DMAX
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Ransomware.Teerac-6201558-0
Kaspersky	Trojan.Win32.Inject.wnfq
BitDefender	Trojan.GenericKD.4506909
NANO-Antivirus	Trojan.Win32.DMAX.emenxr
SUPERAntiSpyware	Ransom.CryptoLocker/Variant
MicroWorld-eScan	Trojan.GenericKD.4506909
Ad-Aware	Trojan.GenericKD.4506909
Sophos	Mal/Generic-S + Mal/Cerber-Z
Comodo	Malware@#1sltxlazbe178
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_CRYPTLOCK.DLFLVW
McAfee-GW-Edition	BehavesLike.Win32.Dropper.fc
FireEye	Generic.mg.fa4e91f478cb00f8
Emsisoft	Trojan.GenericKD.4506909 (B)
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1116907
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Ransom:Win32/Vigorf.A
Arcabit	Trojan.Generic.D44C51D
AegisLab	Trojan.Multi.Generic.4!c
GData	Trojan.GenericKD.4506909
AhnLab-V3	Trojan/Win32.Ransom.C1845825
McAfee	Artemis!FA4E91F478CB
MAX	malware (ai score=100)
TrendMicro-HouseCall	Ransom_CRYPTLOCK.DLFLVW
Rising	Trojan.Generic@ML.99 (RDML:zMp9fKmuz7zVjNLbPTnG+g)
Fortinet	W32/Injector.DMAX!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml