Fasong.Worm.Autorun.DDS removal instruction

The Fasong.Worm.Autorun.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Fasong.Worm.Autorun.DDS virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Fasong.Worm.Autorun.DDS?


File Info:
name: 1AA21C61A852808FA4B8.mlw
path: /opt/CAPEv2/storage/binaries/218d41bec6652c1007c95c63d3d4c4211b62adcdd293d0ba1c3a2fbfbc82fdec
crc32: DBB8CFF0
md5: 1aa21c61a852808fa4b83e693d8c0121
sha1: 38b6cf05285a012749ac4235c6148ad5f7e4c3a9
sha256: 218d41bec6652c1007c95c63d3d4c4211b62adcdd293d0ba1c3a2fbfbc82fdec
sha512: 6d66cb4ce467678774c21c2fb05df31a003ad4c489bc2dd3966323aec32d7727d7222978f3471b41a9271c573c5dc492d275378ac3c781acbf872824c7484aa2
ssdeep: 24576:JZhYZhNrRlNlZhSZhNrRlNlZhYZhNrRlNlZh:JZWZpblZsZpblZWZpblZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DBC56D6BB6C18533C3131A7D9C8B97A5A826BEA02E3964463FF91D4C8F3D78138251D7
sha3_384: 25d78c27d18abaad86f1410e600be598b9a5cfc86af76776a8184cf50b34f897c8f6f8c94ffd3c0cc4a8362a7e1b3a7f
ep_bytes: ff53085bc38b501485d2740652e85308
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Fasong.Worm.Autorun.DDS also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Zusy.398506
FireEye	Generic.mg.1aa21c61a852808f
McAfee	GenericRXAA-FA!1AA21C61A852
Cylance	Unsafe
Sangfor	[INNO_1]
K7AntiVirus	Trojan ( 004bcce41 )
Alibaba	Worm:Win32/Fasong.1031
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.5285a0
Baidu	Win32.Trojan-PSW.OLGames.bm
Cyren	W32/Fasong.F.gen!Eldorado
Symantec	Trojan.Gen.2
tehtris	Generic.Malware
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Fasong-9910797-0
BitDefender	Gen:Variant.Zusy.398506
Avast	Win32:PWSX-gen [Trj]
Tencent	Trojan.Win32.Scar.16000123
Ad-Aware	Gen:Variant.Zusy.398506
Emsisoft	Gen:Variant.Zusy.398506 (B)
Comodo	Packed.Win32.MUPX.Gen@24tbus
McAfee-GW-Edition	BehavesLike.Win32.Generic.vh
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Zusy.398506
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Trojan/Win32.SGeneric
Arcabit	Trojan.Zusy.D614AA
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
ALYac	Gen:Variant.Zusy.398506
MAX	malware (ai score=82)
Malwarebytes	Fasong.Worm.Autorun.DDS
TrendMicro-HouseCall	TROJ_GEN.R002H0CAO22
Rising	Worm.Fasong!1.D14C (CLOUD)
Ikarus	Worm.Win32.Fasong
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZelphiF.34606.GoZ@amMLMhb
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Fasong.Worm.Autorun.DDS?

Fasong.Worm.Autorun.DDS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X