Win32/Injector.EKIU removal

The Win32/Injector.EKIU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Injector.EKIU virus can do?

Executable code extraction
Creates RWX memory
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs

How to determine Win32/Injector.EKIU?


File Info:
crc32: 619DE342
md5: 67d2129bbaa9e52fa9387cd9f0ec64bc
name: jan22.bin
sha1: f7aad87a6a657cb6bb317cf13a613b15a311f5ab
sha256: 22f503023060f742698fa8180cb18ab09515fa7ab6a881907705145040c91e11
sha512: 9cb57345f827f76fa93d80bcb51aef9c8b2261a742d7424cbc9b846e9f604a92c452663262b61f046264ec28869c7b92fd991f64a91b2f799fd4ca12f9d5b52a
ssdeep: 3072:KJy+bnr+O1c5GWp1icKAArDZz4N9GhbkrNEk1xU/ttYhVoD:KJy+bnr+/p0yN90QEB/t0i
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Win32/Injector.EKIU also known as:

FireEye	Generic.mg.67d2129bbaa9e52f
Qihoo-360	Generic/Trojan.fe9
ALYac	Backdoor.Remcos.A
Cylance	Unsafe
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.a6a657
APEX	Malicious
Avast	Win32:Trojan-gen
GData	Win32.Trojan.Injector.VO0473
Kaspersky	Trojan.Win32.Vebzenpak.bfw
Alibaba	Trojan:Win32/Vebzenpak.ab1be46b
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Injector.ladwk
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dm
Ikarus	Trojan-Spy.Agent
Webroot	W32.Trojan.Gen
Avira	TR/Injector.laxfb
Endgame	malicious (high confidence)
ZoneAlarm	Trojan.Win32.Vebzenpak.bfw
Microsoft	Trojan:Win32/Tiggre!rfn
McAfee	RDN/Generic.dx
Malwarebytes	Trojan.Injector
ESET-NOD32	a variant of Win32/Injector.EKIU
Rising	Trojan.Injector!8.C4 (CLOUD)
Fortinet	W32/EKIU!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Win32/Injector.EKIU?

Win32/Injector.EKIU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X