Win32/Injector.DQCE removal guide

The Win32/Injector.DQCE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DQCE virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Spoofs its process name and/or associated pathname to appear as a legitimate process
• CAPE detected the TrickBot malware family
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Win32/Injector.DQCE?

File Info:
name: 1D1199A4E9824DA0CDA9.mlw
path: /opt/CAPEv2/storage/binaries/7754904ddd9031c47adcf4ed3246a8717dd6a6102827820c259950bd77515953
crc32: BE3E52E4
md5: 1d1199a4e9824da0cda93fc5420fb050
sha1: 1700230330149601491df1deb3660962d05baca0
sha256: 7754904ddd9031c47adcf4ed3246a8717dd6a6102827820c259950bd77515953
sha512: dea26c88da2d1dbe2e122d2b455f4c18717309c95e11684545600b36983b38f9404faf6c3bb1ebefee546bb76737f8e7296442e75803d189b0704e8294aa9a5f
ssdeep: 12288:HmUCq7CR9ZAnSOhXZmQZAcy9Wp0GIeWy6MPLzyfDRtROhUO0dGzSc3F:GxfjZoSatZAcKW1F6XfMh4OSa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B8E4AE22F2E05833D173263D9C1B9764983ABE103E28AD4A2BF91D4D5F7D7813979293
sha3_384: 2996d8bb27f8765ac356391c70864c148373b8ab3d1ec02acb92135dc061a6b6a550a0fad9f6d342a1996e0efb977426
ep_bytes: 558bec83c4f0b8381c4600e8403efaff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Win32/Injector.DQCE also known as:

How to remove Win32/Injector.DQCE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.