Should I remove “Win32/Injector.XYG”?

The Win32/Injector.XYG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.XYG virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics

How to determine Win32/Injector.XYG?

File Info:
name: F193DAEF24938A523750.mlw
path: /opt/CAPEv2/storage/binaries/8164d0192e846257f77e4a8b600a30992c5631e395145abb75a8aafe78c6e8c8
crc32: F6DBF8C4
md5: f193daef24938a5237504498d03f3157
sha1: e715c7bcb4cdc6384bf0f83a900ac44d853cfd6e
sha256: 8164d0192e846257f77e4a8b600a30992c5631e395145abb75a8aafe78c6e8c8
sha512: a7110b1f7c443d4297fda1f2f366a60b10825e8588923446c466829e05a5ee516649fced5f47dd02ab7da6f511f3f713d06bab0291288b05d2a811135b79e090
ssdeep: 3072:sIjYWOyhB/aYQxwca9EjmAa5MAWKC35AJU0Km4xZqMTwAeK2JjXB:sIqs/gwcaejy+l58U0KeUZbSjx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151141252D5575CF6D98E1FFCC8E5B72C5B7E7FA25CA1C4F8CC810D89A41930029A8AB4
sha3_384: 88081a3d81ff8b3ff2a549637011b774c18e831e6a64986a1424588ff7ad7421b45f8c99e4a81313b7760914b0ebc8a2
ep_bytes: 558bec83c4f0b868424000e8e4f3ffff
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: ICQ, LLC.
FileDescription: ICQ
FileVersion: 7.8.0.6800
InternalName: ICQ
LegalCopyright: Copyright (c) 1998-2010 ICQ, LLC.
LegalTrademarks: 
OriginalFilename: ICQ.exe
ProductName: ICQ
ProductVersion: 7.8.0.6800
DistId: 30015
Translation: 0x0409 0x04b0

Win32/Injector.XYG also known as:

How to remove Win32/Injector.XYG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.