Win32/Injector.EQYH removal instruction

The Win32/Injector.EQYH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EQYH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Exhibits behavior characteristics of GuLoader
• Uses suspicious command line tools or Windows utilities

How to determine Win32/Injector.EQYH?

File Info:
name: 33332F7B132AD589CD77.mlw
path: /opt/CAPEv2/storage/binaries/7796d3341e1e6fb0c3c0fe495b592b9946c93fb6cdc26f955827b5ab2c8ba5a6
crc32: E69751ED
md5: 33332f7b132ad589cd77f6dd79b1c399
sha1: f184f15b69266a9296c4e7380da255a4d4fc29d0
sha256: 7796d3341e1e6fb0c3c0fe495b592b9946c93fb6cdc26f955827b5ab2c8ba5a6
sha512: 88903d6c9779611bafc5aab675b8a0bc60fb56d952833ec81c9dad6cfb4cbd93f1b65c6eb501ed93da43b47db9fdb0508dca81e5c726a7ba68b03c24a3f1ed84
ssdeep: 3072:2g888888888SVHgPmRCLGvte7m5n6Ixe8WsV4YnKjj1f888888888O:N888888888S5gekGFd6+eMVBKjjN888j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DDE31866B92BD461E5FAC470A863AEDE3A1F7F7248410C4772D83F4A3930582E4A571F
sha3_384: 974ff316a4bdf860c6878fc41e5c1b62498362a87f52ce4d811ea253ea6676e7a3b0a16794adb2706532630afbcb8c8c
ep_bytes: 685c364000e8f0ffffff000000000000
timestamp: 2011-10-20 17:35:46

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Vitrum
ProductName: Vitrum
FileVersion: 2.00
ProductVersion: 2.00
InternalName: Outflankeddi
OriginalFilename: Outflankeddi.exe

Win32/Injector.EQYH also known as:

How to remove Win32/Injector.EQYH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.