Categories: Worm

Eggnog.Worm.Autorun.DDS malicious file

The Eggnog.Worm.Autorun.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Eggnog.Worm.Autorun.DDS virus can do?

  • Sample contains Overlay data
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Likely virus infection of existing system binary

How to determine Eggnog.Worm.Autorun.DDS?


File Info:

name: DDE36AD1706F526F1AF2.mlwpath: /opt/CAPEv2/storage/binaries/c86c971e6cc5c6aa1bf29af80b728f8bd27b59657abd41f64402952c4fe721f1crc32: 06E87F4Amd5: dde36ad1706f526f1af24eed7fe1746dsha1: e28b01f5c9b787c881f9e4c93460831ff3af8567sha256: c86c971e6cc5c6aa1bf29af80b728f8bd27b59657abd41f64402952c4fe721f1sha512: 75951d7659c7db9ecc777d700b7b1928c0ef742055f2b99c1e675e5117b92796f40749f245071b187bec57dc17c0d3313ec88b5511744aae645549f659b9fabessdeep: 1536:YFqF3aQSmQjyJDcdyFPPXI8QBAA9AVUIJtgt1/nTLvzagyeQQ9:YFqFKbADTPl498/0t1PDyeR9type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T187B3F192F2E04A37E962C6FAEC93D208DB6C7B101D541893FFAE0BDC4434697643E1A5sha3_384: 2f2907ed9d50be4f8dcdea47de57ff9b9e852e1c7af4438ebb9644ac9bdee39f2f70023c2a0feda726e51352f0ff7e9cep_bytes: 55545d83c4f0b81c584000e84cd1fffftimestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Eggnog.Worm.Autorun.DDS also known as:

Bkav W32.FamVT.EggogKA.Worm
MicroWorld-eScan Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh
FireEye Generic.mg.dde36ad1706f526f
CAT-QuickHeal Worm.Eggnog.B8
ALYac Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh
Cylance Unsafe
VIPRE Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh
K7AntiVirus EmailWorm ( 00575a021 )
K7GW EmailWorm ( 00575a021 )
CrowdStrike win/malicious_confidence_100% (D)
BitDefenderTheta AI:Packer.685EE64521
VirIT Worm.Win32.EGGNOG
Cyren W32/Eggnog.D.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Eggnog.E
Baidu Win32.Worm.Eggnog.a
ClamAV Win.Worm.Fearso-7358009-0
Kaspersky HEUR:Worm.Win32.Generic
BitDefender Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh
NANO-Antivirus Trojan.Win32.Delphi.iaqzwy
APEX Malicious
Tencent Worm.Win32.Eggnog.b
Ad-Aware Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh
Emsisoft Gen:Trojan.P2P-Worm.gGZ@aS@t3Rh (B)
DrWeb Win32.HLLW.Google.24576
Zillya Worm.Eggnog.Win32.169
McAfee-GW-Edition BehavesLike.Win32.Eggnog.ch
Trapmine malicious.high.ml.score
Sophos ML/PE-A + Troj/Agent-AJFK
Ikarus Email-Worm.Win32.Fearso
GData Win32.Worm.Fearso.A
Jiangmin Worm/Eggnog.edc
Avira DR/Delphi.Gen
MAX malware (ai score=80)
Antiy-AVL Trojan/Generic.ASMalwS.7B8
Arcabit Trojan.P2P-Worm.E90D2D
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Xema.C30728
Acronis suspicious
McAfee W32/Eggnog.worm.gen
VBA32 Win32.Malware.Dropper.Heur
Malwarebytes Eggnog.Worm.Autorun.DDS
Avast Win32:Eggnog [Wrm]
Rising Worm.P2p.Eggnog.a (CLASSIC)
SentinelOne Static AI – Malicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Eggnog.E!worm
AVG Win32:Eggnog [Wrm]
Cybereason malicious.1706f5
Panda Trj/Genetic.gen

How to remove Eggnog.Worm.Autorun.DDS?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

Zusy.546247 (file analysis)

The Zusy.546247 is considered dangerous by lots of security experts. When this infection is active,…

2 mins ago

About “Trojan:Win32/AgentTesla!rfn” infection

The Trojan:Win32/AgentTesla!rfn is considered dangerous by lots of security experts. When this infection is active,…

13 mins ago

What is “Trojan.Agent.DQLS”?

The Trojan.Agent.DQLS is considered dangerous by lots of security experts. When this infection is active,…

18 mins ago

What is “Backdoor:Win32/Rbot!F”?

The Backdoor:Win32/Rbot!F is considered dangerous by lots of security experts. When this infection is active,…

32 mins ago

Should I remove “Generic.Dacic.94CCEEA9.A.FF35E4E1”?

The Generic.Dacic.94CCEEA9.A.FF35E4E1 is considered dangerous by lots of security experts. When this infection is active,…

33 mins ago

Generic.Dacic.94CCEEA9.A.EE53247E removal tips

The Generic.Dacic.94CCEEA9.A.EE53247E is considered dangerous by lots of security experts. When this infection is active,…

38 mins ago