Categories: Malware

How to remove “Win32/Injector.EOEK”?

The Win32/Injector.EOEK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EOEK virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
A process created a hidden window
Creates a hidden or system file
Attempts to create or modify system certificates
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

i.imgur.com

How to determine Win32/Injector.EOEK?


File Info:
crc32: 3CDFE82Dmd5: 023ae9c9494ea1d4c24dcbfe7892c611name: 023AE9C9494EA1D4C24DCBFE7892C611.mlwsha1: 2fff1f353cb6946d6f226050e710d4bc0cf4d16esha256: 2c1cef7d208ce8f0094415d06cc61fa37dd9c9308cfcd9fde0f7a32703220e90sha512: d2f1a3a1539a3e2359df28b274da3676718ccf2500ccceb8ed7e695d1e18b5344551b68a27c501c0ee4e0279f357b684ab1b04d3929357d6d478e26237e82d25ssdeep: 98304:iMEYG4Eyadcj/AtKjQ/iKFjlG9WaRvNOK:iMEqdy0ciKFjC0type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
ProductName: ElexrerProgramID: ElexrerFileDescription: ElexrerFileVersion: 5.3.2.0ProductVersion: 1.0.0.0Translation: 0x0409 0x04e4

Win32/Injector.EOEK also known as:

Bkav	W32.AIDetectVM.malware1
DrWeb	Trojan.DownLoader36.30529
MicroWorld-eScan	Trojan.GenericKD.45148003
FireEye	Trojan.GenericKD.45148003
CAT-QuickHeal	Trojan.Netwire
Qihoo-360	Win32/Trojan.483
ALYac	Trojan.GenericKD.45148003
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic.pak!cobra
Sangfor	Malware
BitDefender	Trojan.GenericKD.45148003
Cyren	W32/Trojan.IYWT-4084
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.NetWire.vho
Alibaba	Trojan:Win32/NetWire.50c0a595
ViRobot	Trojan.Win32.Z.Wacapew.6110721
AegisLab	Trojan.Win32.NetWire.4!c
Tencent	Malware.Win32.Gencirc.11b7f992
Ad-Aware	Trojan.GenericKD.45148003
Sophos	Generic PUA CP (PUA)
F-Secure	Trojan.TR/NetWire.eginn
TrendMicro	TROJ_GEN.R002C0GLS20
McAfee-GW-Edition	BehavesLike.Win32.Dropper.th
Emsisoft	Trojan.GenericKD.45148003 (B)
Ikarus	Trojan.SuspectCRC
Avira	TR/NetWire.eginn
MAX	malware (ai score=80)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Ymacco.AA2C
Gridinsoft	Trojan.Win32.Downloader.oa
Arcabit	Trojan.Generic.D2B0E763
ZoneAlarm	HEUR:Trojan.Win32.NetWire.vho
GData	Trojan.GenericKD.45148003
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.Generic.C4278934
McAfee	Artemis!023AE9C9494E
VBA32	Trojan.NetWire
Malwarebytes	Backdoor.NetWiredRC
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Injector.EOEK
TrendMicro-HouseCall	TROJ_GEN.R002C0GLS20
Yandex	Trojan.NetWire!oWqBe1Vyx6o
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_95%
Fortinet	W32/NetWire.EJIJYPE!tr
AVG	Win32:Malware-gen