Analysis of the TJprojMain Executable Infector

Recently I discovered a severe malware infection on my development machine that actively hijacked my software builds. This document serves to explain the behavior of this malware, its symptoms, and the correct method for its complete removal.

The Discovery

While compiling a Python application into a standalone executable, I noticed that the resulting file properties were completely stripped and replaced. Instead of the expected metadata, the newly built executable showed the following properties:

• Original filename: TJprojMain.exe
• Product name: Project1
• File version: 1.0.0.0

Caution

DO NOT OPEN THE EXECUTABLE! If you check the properties of an .exe file and see TJprojMain.exe as the original filename, the file is already compromised. Running it will immediately infect your system.

Additionally, the compiled applications suddenly required unexpected Administrator (UAC) permissions to run, indicating that their internal application manifests had been tampered with or removed.

How the Malware Operates

After investigating the issue, I realized that this was not a bug with the compiler or packaging tools. My machine had been compromised by an aggressive Win32 file-infector virus.

The malware operates through the following stages:

1. Active Monitoring: The virus runs silently in the background as a process. In my case, it had infected a legitimate tool in my workspace and embedded itself in the Windows registry to run automatically on startup.
2. Instant Infection: It actively monitors the file system for the creation of new executable files. When a development tool (like PyInstaller or the .NET SDK) finishes building an executable, the virus immediately intercepts the file.
3. Payload Injection: Before the developer even has a chance to run the newly compiled software, the virus injects its own malicious payload into the executable. It overwrites the Win32 properties to display the TJprojMain signature and strips embedded application manifests.
4. Propagation: Because the newly compiled application is now a "carrier," anyone who receives or downloads this software will unknowingly run the virus, allowing it to spread to their system and begin the cycle anew.

Primary Threat

The malware is fundamentally an executable infector designed to spread rapidly. However, its primary payload on an infected host typically involves:

• Cryptocurrency Mining: It drops hidden components (often disguised as system files like svchost.exe or spoolsv.exe inside the C:\Windows\Resources\ directory) that utilize the infected computer's CPU and GPU resources to silently mine cryptocurrency in the background.
• Backdoor Capabilities: As a persistent threat, it has the capability to reach out to remote servers to download and execute additional malicious payloads.

The Solution

Attempting to manually delete the malware processes or rely on simple batch scripts is entirely insufficient. Manual deletion only targets the active running process, leaving all the compromised .exe files on the hard drive intact. The next time any infected program is launched, the virus will instantly reinstall itself.

To properly eradicate the infection without destroying legitimate applications, a specialized disinfection tool is required to surgically extract the malicious code from infected executables.

I strongly recommend using the free Kaspersky Virus Removal Tool (KVRT) to clean the system: https://www.kaspersky.com/downloads/free-virus-removal-tool

When running the tool, ensure that the action for all detected objects is set to "Cure". This instructs the antivirus to remove the injected malware payload from your executables while preserving your original applications and data safely.

Scan Results