Win32/Injector.ENSH removal instruction

The Win32/Injector.ENSH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.ENSH virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• A process attempted to delay the analysis task by a long amount of time.
• Created a process from a suspicious location

How to determine Win32/Injector.ENSH?

File Info:
name: 4FB3D7F808AAC31699E4.mlw
path: /opt/CAPEv2/storage/binaries/2d0ef2f9448ec8ad1032b1ba3eefcf74269562f74e5e8221936d5fdd5540b01b
crc32: 441A492B
md5: 4fb3d7f808aac31699e49b2b19824691
sha1: 50e922b496026e43dec05950ff6415514b69ed91
sha256: 2d0ef2f9448ec8ad1032b1ba3eefcf74269562f74e5e8221936d5fdd5540b01b
sha512: e8adfac93df5ea73cf17ed6bded5543c982fcda4fdbf826ec368094b49c2ef4da9658c36e0257fc66a5a79cd6a3b0e225b545ca90cfdadad6c73b313882145b4
ssdeep: 49152:Q/AB8einh+n3WH3d+Jte1zv98DnMCP2MxcDs4lUztkIvll0RB48SzRa52zaliQVQ:CAB8eingBgv95Q1aZ+JP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D84638FDA04736CDDFB34039EA777CC0FA09465B1D63563E712EC689A0BA3688529943
sha3_384: 197087b6de73ba9dccddad6747dbbbfea339b2453c92f5b2fb7139b22c4afb6df174fa10b76a968e987072225e344c08
ep_bytes: e8c6060000e974feffff558beceb0dff
timestamp: 2020-03-29 00:53:21

Version Info:
CompanyName: GBE cOmp
FileDescription: Intellectual privacy
FileVersion: 1.0.0.1
InternalName: STUB.exe
LegalCopyright: Copyright (C) 2020
OriginalFilename: STUB.exe
ProductName: IE-p
ProductVersion: 1.0.0.1
Translation: 0x0419 0x04b0

Win32/Injector.ENSH also known as:

How to remove Win32/Injector.ENSH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.