Should I remove “AutoIt:Balero-F [Wrm]”?

The AutoIt:Balero-F [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What AutoIt:Balero-F [Wrm] virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid

How to determine AutoIt:Balero-F [Wrm]?


File Info:
name: E59EDBD005D33E1E8C67.mlw
path: /opt/CAPEv2/storage/binaries/521e473d5a537f10566ea35cb24efd155abdd8f0d604f4b949060360ccd50d63
crc32: 3F37E8FB
md5: e59edbd005d33e1e8c670109a551299d
sha1: 673b91ea6df963a1bdabe213c09f5ae0bd96b84a
sha256: 521e473d5a537f10566ea35cb24efd155abdd8f0d604f4b949060360ccd50d63
sha512: 66b6103dd8f38c2c920219fa86d944af893224366e4e3651dec7f3309f726676437b799347229ebb45e393c82ad33a1283a7b7a510a001536281233df5317c91
ssdeep: 49152:RKmzGM9biRSooUlcZx3up6xRyXbzN14FDR0V79S:RK4GMISI0Ep6vyXbzN14AVw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12695239DB188D0B5E69271B07162B7377B36FD80E7228D876A8DEB1A7C33159470231B
sha3_384: edcebe151fdbf7b6b5293f9e86ade7bd16348b07bd07bdbb8f0d243964734540fd7343aaf0d9d92229fa3e76191da930
ep_bytes: 558bec6aff68983742006838f4410064
timestamp: 2011-12-08 07:35:06

Version Info:
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 2, 0, 0, 43
InternalName: 
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
PrivateBuild: 
ProductName: NeGaTiF Kurulum Sihirbazý
ProductVersion: 2, 0, 0, 43
SpecialBuild: 
Translation: 0x0409 0x04b0

AutoIt:Balero-F [Wrm] also known as:

Bkav	W32.Common.C1F02FBF
Lionic	Trojan.Win32.Generic.4!c
McAfee	Artemis!E59EDBD005D3
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Trojan.Win32.Autoit.Vd61
K7AntiVirus	Trojan ( 0055e3de1 )
Alibaba	Packed:Win32/Balero.e4090d4b
K7GW	Trojan ( 0055e3de1 )
Cybereason	malicious.a6df96
ESET-NOD32	Win32/Packed.Autoit.H suspicious
APEX	Malicious
Avast	AutoIt:Balero-F [Wrm]
Tencent	Malware.Win32.Gencirc.1150517f
McAfee-GW-Edition	Artemis
Xcitium	Malware@#emt1egpmgigp
Microsoft	Program:Win32/Wacapew.C!ml
Google	Detected
Cylance	unsafe
Rising	Trojan.Generic@AI.94 (RDML:0FKiuXjne2j2XSzMzCndzw)
Ikarus	Win32.Malware.gen3x
Fortinet	PossibleThreat
AVG	AutoIt:Balero-F [Wrm]
DeepInstinct	MALICIOUS

How to remove AutoIt:Balero-F [Wrm]?

AutoIt:Balero-F [Wrm] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X