insnts.exe

Last Updated on Thursday, 06 October 2011 00:48 Wednesday, 05 October 2011 04:02

Trojan - Win32 VBInject

Here is a suspicious malicious virus installer that saves a files named insnts.exe,  You can see the report on this link

This file is created in the %AppData% folder, where no legitimate programs create EXE files. Hence it becomes suspicious. 

Just because a virus writer decides to give a name to a virus file, that does not make the name itself outlawed. So you need to take necessary precautions while deciding whether a file on your computer is legitimate or not. Read this Disclaimer

• It creates these files at
  %AppData%\insnts.exe
• And these folders
  -
  To know the path of %AppData% on your version of Windows, see this link
• The installer is of about 208 Kilobytes.
• It creates a startup registry entry so that the file insnts.exe runs each time windows starts.
• It could be used to download malicious files on the computer

Can Antivirus programs detect it?

Some antivirus programs may detect this virus file as
Trojan.Win32.VBKrypt.ary [Kaspersky Lab]
W32/Rimecud.gen.u [McAfee]
Virus.Win32.VBInject [Ikarus]

How do I get infected? Can it be avoided?

Small files like these can enter a computer unnoticed while browsing on the net. It is called a drive by download. And there are ways to prevent it from happening. You can read them on this link here

So what should I do now?

You need to delete this or any other suspicious files that could be seen running in Task manager. Also do not forget to run a scheduled boot scan using the antivirus program on your computer. A good firewall can prevent and help you to block or detect if there is any hidden communication between a file on your computer and someone else on the internet. So keep a close eye on these activities through your Firewall.

Don't you write detailed Step by step instructions?

Yes, I do. But in order to avoid looking cumbersome, I have grouped all the commonly followed steps that can be applied to any or all of the viruses. In case you need them they are here on this link.

The above information is based on Automated virus analysis report form Threatexpert.com.

Sanjay C Rajure

If you come across any difficulties in removing the above virus, send your queries in the Help Forum