About "Win32/Injector.DVGJ" infection

The Win32/Injector.DVGJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DVGJ virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
Executed a process and injected code into it, probably while unpacking
Attempts to remove evidence of file being downloaded from the Internet
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Injector.DVGJ?


File Info:
crc32: 8CA09C2D
md5: dde83e036310eb47e065a281e85fdff6
name: DDE83E036310EB47E065A281E85FDFF6.mlw
sha1: 2f3f378947bd35188de98785fee07e0cecb6f09d
sha256: 0d20f38882fc1897f6a0a392fdd6ad538e2bb31ef43afff9a1a49951e7f2ffbe
sha512: d30ae8ddb5a6e944403495e2f6eb59ff4c7b74bc828e45305b09fd0de50a293f267dd2e87eebeb93980179266f435b2f2791545c27d62a772f7bc94e4a8b81be
ssdeep: 49152:TXz+ox1Y8sBojxRv7OFs+ehLJ2MVOSZ7cbfeGN:TXz+D8sBWxB79+ehLt08QbmGN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: 1600X1200                                                                                           
FileDescription: PHOTO JPG IMAGES 1.00 Installation                          
FileVersion: 1.00                
Comments: 
CompanyName: 1600X1200                                                   
Translation: 0x0409 0x04e4

Win32/Injector.DVGJ also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 005249891 )
DrWeb	Trojan.Encoder.567
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.MauvaiseRI.S5252058
ALYac	Trojan.Ransom.Cryakl
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Ransom:Win32/Cryakl.1257dd99
K7GW	Trojan ( 005249891 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.DVGJ
APEX	Malicious
Avast	Win32:Splitter-A [Trj]
Kaspersky	Trojan-Ransom.Win32.Cryakl.aql
NANO-Antivirus	Trojan.Win32.Zonidel.exevml
Tencent	Win32.Trojan.Cryakl.Wwoe
Sophos	Mal/Generic-S
Comodo	Malware@#1flqdcv5jxbvx
BitDefenderTheta	Gen:NN.ZexaF.34170.YqKfamICZlmm
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_Cryakl.R002C0GE621
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
FireEye	Generic.mg.dde83e036310eb47
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1117667
Antiy-AVL	Trojan/Generic.ASMalwS.26F8FF7
Microsoft	Trojan:Win32/Tnega!ml
ZoneAlarm	Trojan-Ransom.Win32.Cryakl.aql
McAfee	Artemis!DDE83E036310
MAX	malware (ai score=99)
VBA32	Trojan-Ransom.Cryakl
Panda	Trj/CI.A
TrendMicro-HouseCall	Ransom_Cryakl.R002C0GE621
Yandex	Trojan.Cryakl!4ZCw2g/p4vI
Ikarus	PUA.CoinMiner
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Fortinet	W32/Injector.DVGJ!tr
AVG	Win32:Splitter-A [Trj]
Paloalto	generic.ml

How to remove Win32/Injector.DVGJ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Win32/Injector.DVGJ” infection