Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Apr 19, 2010 | Updated Sep 15, 2017

VirTool:Win32/VBInject.FF

Detected by Microsoft Defender Antivirus

Aliases: W32/Trojan2.KQPB (Command) Trojan.Win32.VBKrypt.bd (Kaspersky) Trojan.VBKrypt.EG (VirusBuster) TR/VBKrypt.BD.2 (Avira) Win32/VBInject!generic (CA) Win32/Injector.AFZ (ESET) Trojan.Win32.VBKrypt (Ikarus) Trj/Inject.GT (Panda) Mal/VBDrop-I (Sophos) TROJ_KREEPER.G (Trend Micro)

Summary

VirTool:Win32/VBInject.FF is a detection for certain forms of obfuscated malware. The loader is written in Visual Basic and the malicious code is stored encrypted. The original file behaves as a loader for the encrypted malicious code, thus the code could have virtually any purpose.
 
When run, the code is decrypted and injected into the current process, so the resulted code is never written to disk, in an attempt to avoid being detected by security software. It contains code and techniques to hinder disassembly and analysis.
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.
Follow us