Win32/Injector.EJWM removal instruction

Malware Removal

The Win32/Injector.EJWM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/Injector.EJWM virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • Drops a binary and executes it
  • Executed a process and injected code into it, probably while unpacking
  • Steals private information from local Internet browsers
  • Creates a copy of itself
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

How to determine Win32/Injector.EJWM?


File Info:

crc32: AAB36579
md5: b7f7a054982020704cf211a36dfbf7e9
name: enginekey.exe
sha1: 66e5c35cd9ff9cbc373e34164d651e0bdea046cc
sha256: 1985c1a778916bb969282576f2d313c526632645b4ec28c8084b7693d7a9ea36
sha512: f6a2fcb1fe3e69ff6544ae7b2494bedc71cc7f4488e7876c92f2b7b80ede538772085c5cefebc9011e566507532ce7b28a9f743917e3527d988fa9588327020a
ssdeep: 12288:qd1ULdSgfT1qsUJ+zoC+IOmx0VVSDLklRZBnbRz5E5MYQaV3PnrJ/xvNGpsQPjbU:3Br12J+z4mOyncbXwQaV3PN/3GpzjA
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/Injector.EJWM also known as:

MicroWorld-eScanGen:Variant.Ursu.731349
McAfeeRDN/Generic.hbg
CylanceUnsafe
CrowdStrikewin/malicious_confidence_90% (W)
BitDefenderGen:Variant.Ursu.731349
K7GWTrojan ( 0055ead51 )
K7AntiVirusTrojan ( 0055ead51 )
ArcabitTrojan.Ursu.DB28D5
Invinceaheuristic
SymantecInfostealer.Lokibot!36
ESET-NOD32a variant of Win32/Injector.EJWM
APEXMalicious
KasperskyHEUR:Trojan.Win32.Kryptik.gen
Endgamemalicious (high confidence)
EmsisoftGen:Variant.Ursu.731349 (B)
F-SecureTrojan.TR/Kryptik.coame
DrWebTrojan.PWS.Stealer.19347
TrendMicroTSPY_HPLOKI.SMBD
McAfee-GW-EditionBehavesLike.Win32.Fareit.ch
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.b7f7a05498202070
SophosMal/Fareit-V
IkarusTrojan.Win32.Krypt
WebrootW32.Trojan.Gen
AviraTR/Kryptik.coame
FortinetW32/Agent.AJFK!tr
MicrosoftTrojan:Win32/Wacatac.B!ml
ZoneAlarmHEUR:Trojan.Win32.Kryptik.gen
AhnLab-V3Win-Trojan/Delphiless02.Exp
Acronissuspicious
ALYacSpyware.LokiBot
MAXmalware (ai score=89)
Ad-AwareGen:Variant.Ursu.731349
PandaTrj/CI.A
TrendMicro-HouseCallTSPY_HPLOKI.SMBD
RisingTrojan.Lokibot!8.F1B5 (CLOUD)
eGambitUnsafe.AI_Score_99%
GDataGen:Variant.Ursu.731349
BitDefenderThetaGen:NN.ZelphiF.34080.YGW@aWhHy1ki
Cybereasonmalicious.cd9ff9
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.469

How to remove Win32/Injector.EJWM?

Win32/Injector.EJWM removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment