Categories: Malware

How to remove “Win32/Injector.EION”?

The Win32/Injector.EION file is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Win32/Injector.EION virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Attempts to restart the guest VM
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Win32/Injector.EION?


General:

Operating System: Windows 7 / 8 / 8.1 / 10 Virus Name: Trojan.Chapak!

File Info:

Name: starticon4.exe

Size: 743424

Type: PE32 executable (GUI) Intel 80386, for MS Windows

MD5: bd220958840ee7f11ae5e915c84da593

SHA1: cb8513096381660ec4648a61184fe4ac23c279f1

SH256: 02a13ebd9224c7cc323da1cd280ad86b22f2afb8ec46c5de746ce07cd872e65b

Version Info:

[No Data]

Win32/Injector.EION also known as:

ALYac Trojan.Ransom.Stop
APEX Malicious
AVG Win32:CrypterX-gen [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKD.41955490
AegisLab Trojan.Win32.Zbot.m6l9
AhnLab-V3 Trojan/Win32.MalPe.R296108
Alibaba Trojan:Win32/Chapak.43b0f65c
Antiy-AVL Trojan[Downloader]/Win32.Dofoil
Arcabit Trojan.Generic.D28030A2
Avast Win32:CrypterX-gen [Trj]
Avira TR/AD.InstaBot.cor
BitDefender Trojan.GenericKD.41955490
BitDefenderTheta Gen:NN.ZexaF.32250.TG0@ae2CNrf
CAT-QuickHeal Ransom.STOP.S8831477
ClamAV Win.Malware.Generic-7366725-0
Comodo Malware@#46crfaxka4mm
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.963816
Cylance Unsafe
Cyren W32/Trojan.RXEV-0450
DrWeb Trojan.DownLoader30.30579
ESET-NOD32 a variant of Win32/Injector.EION
Emsisoft Trojan.GenericKD.41955490 (B)
Endgame malicious (high confidence)
F-Prot W32/Kryptik.API.gen!Eldorado
F-Secure Trojan.TR/AD.InstaBot.cor
FireEye Generic.mg.bd220958840ee7f1
Fortinet W32/GenKryptik.DWJQ!tr
GData Trojan.GenericKD.41955490
Ikarus Trojan-Ransom.Crypted007
Invincea heuristic
Jiangmin Trojan.Chapak.hls
K7AntiVirus Riskware ( 0040eff71 )
K7GW Riskware ( 0040eff71 )
Kaspersky Trojan.Win32.Chapak.ebjm
MAX malware (ai score=100)
Malwarebytes Trojan.MalPack.GS
MaxSecure Trojan.Malware.121218.susgen
McAfee RDN/Generic.grp
McAfee-GW-Edition BehavesLike.Win32.Generic.bc
MicroWorld-eScan Trojan.GenericKD.41955490
Microsoft Trojan:Win32/Predator.PA!MTB
NANO-Antivirus Trojan.Win32.Bandit.gezttb
Paloalto generic.ml
Panda Trj/GdSda.A
Qihoo-360 HEUR/QVM10.2.D41F.Malware.Gen
Rising Trojan.Generic@ML.98 (RDMK:ZuHncFkg1iOirWRZQ4mBJg)
SentinelOne DFI – Malicious PE
Sophos Mal/GandCrab-G
Symantec Trojan.Gen.2
Trapmine malicious.moderate.ml.score
TrendMicro TROJ_GEN.R002C0WJT19
TrendMicro-HouseCall Trojan.Win32.SMOKELOAD.SMD2.hp
VBA32 BScope.Backdoor.HVNC
VIPRE Trojan.Win32.Generic!BT
Webroot W32.Trojan.Gen
Yandex Trojan.Chapak!
Zillya Trojan.Chapak.Win32.84641
ZoneAlarm Trojan.Win32.Chapak.ebjm

How to remove Win32/Injector.EION?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

MSIL/GenKryptik.GXIZ information

The MSIL/GenKryptik.GXIZ is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Malware.AI.2789448175 (file analysis)

The Malware.AI.2789448175 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Jalapeno.1878 removal instruction

The Jalapeno.1878 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

What is “Trojan.Heur3.LPT.YmKfaKBcBekib”?

The Trojan.Heur3.LPT.YmKfaKBcBekib is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

How to remove “Worm.Win32.Vobfus.exmt”?

The Worm.Win32.Vobfus.exmt is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

About “TrojanDownloader:Win32/Beebone.JO” infection

The TrojanDownloader:Win32/Beebone.JO is considered dangerous by lots of security experts. When this infection is active,…

2 months ago