How to remove “Win32/Injector.UEY”?

The Win32/Injector.UEY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.UEY virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)

How to determine Win32/Injector.UEY?

File Info:
name: 98756FC049BD8850960C.mlw
path: /opt/CAPEv2/storage/binaries/4188563d90b6fdf283c65595f15ef96c6d909d2e91ec595cbfe756d327f50214
crc32: 04790324
md5: 98756fc049bd8850960cdfcc7c961685
sha1: 73b55253e3bff0a3d7ca2f87c941f051a0d2a538
sha256: 4188563d90b6fdf283c65595f15ef96c6d909d2e91ec595cbfe756d327f50214
sha512: b89f7c7609b52da3c8b80d31e1a77d8fba78db1f9707ec53579ceb358c870b7636f065068ca03fcff738018a02adf917180f7302952459d30263e51118ba6a85
ssdeep: 3072:mMSdRYdQlt54VO7nPvVB9xhwCOdeuufI+rBjnIz6YTMd+HIwQv6yn/W/EgJ8r33w:mndA5VYtxOLw7fB1nxldKIVvFW/fOr3w
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1102402337195ACC7E9A658B42E3ACC5D65153C685C32ECA376A8332C77F4958C814FB2
sha3_384: 2ad8e51ea0516cda6fff541a46aebd5ac2461d3aa3c937cc084bbaa8cc21e3b82df2d82707b26829b1fc62a811ddb45d
ep_bytes: 60be004042008dbe00d0fdffc7877c07
timestamp: 2012-07-20 08:41:09

Version Info:
CompanyName: ICQ, LLC.
FileDescription: ICQ
FileVersion: 7.8.0.6800
InternalName: ICQ
LegalCopyright: Copyright (c) 1998-2010 ICQ, LLC.
LegalTrademarks: 
OriginalFilename: ICQ.exe
ProductName: ICQ
ProductVersion: 7.8.0.6800
DistId: 30015
Translation: 0x0409 0x04b0

Win32/Injector.UEY also known as:

How to remove Win32/Injector.UEY?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.