Win32/Injector.EJDH removal guide

The Win32/Injector.EJDH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EJDH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Behavioural detection: Injection (Process Hollowing)
• CAPE detected the Remcos malware family
• Creates a copy of itself
• Creates known Remcos mutexes
• Creates known Remcos registry keys
• Anomalous binary characteristics

How to determine Win32/Injector.EJDH?

File Info:
name: A2EB304D127DE914541D.mlw
path: /opt/CAPEv2/storage/binaries/0042f3d4c6f963e9c3cd2e58fbb2f08a1922c5855883ee7bf26e52a3997cf4dc
crc32: D0858B3F
md5: a2eb304d127de914541d5eeeac187ec6
sha1: d6763e841013fbe65c347fe7509e1eb64e2f0b78
sha256: 0042f3d4c6f963e9c3cd2e58fbb2f08a1922c5855883ee7bf26e52a3997cf4dc
sha512: da8ccf691859659bb3c862a1f48059c4b114b116d428ac192bac1ca0e2a53a7b1097342019457b246979a46034a4337958fd3227fc421868ac0374842c516ef0
ssdeep: 196608:eJYTj0lKiadMY6fs2DRnCqzkhX+wjAvWqbgxGNmuz/QXh6eaat735UKmRUNhbH:OE01dY6k2bCEvrgcNtz6hRDiKAkhj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B5D6237B707628B1E57D1BF25A857AB2489ECD7F18C40846A2D835F404B6135CCBCBBA
sha3_384: e5ea8ec3434d0d12ad66931e4f44c4d32141c1ee816b4888b90b4ee2e4674d7674873c855c83a74cd72f9d76d8f9e480
ep_bytes: 68d0c14800e8f0ffffff000000000000
timestamp: 2014-08-04 05:43:52

Version Info:
Translation: 0x0409 0x04b0
Comments: AUTO
CompanyName: Don HO don.h@free.fr
FileDescription: Notepad++ : a free (GNU) source code editor
LegalCopyright: Copyleft 1998-2016 by Don HO
ProductName: Notepad++
FileVersion: 7.71
ProductVersion: 7.71
InternalName: Notepad++
OriginalFilename: Notepad++.exe

Win32/Injector.EJDH also known as:

How to remove Win32/Injector.EJDH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.