Categories: Worm

MemScan:Win32.Worm.Autorun.SY removal guide

The MemScan:Win32.Worm.Autorun.SY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MemScan:Win32.Worm.Autorun.SY virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Disables Windows firewall
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine MemScan:Win32.Worm.Autorun.SY?


File Info:
name: 8D330A213AC727C65EB6.mlwpath: /opt/CAPEv2/storage/binaries/b413e22caec4b17e12b9daeb66f74cb401bd7797eee9b4ee2031c778ec1418a0crc32: 6130F864md5: 8d330a213ac727c65eb68acfdbb8312fsha1: 3adaedae7ee11c0f274c60475db1db190930f159sha256: b413e22caec4b17e12b9daeb66f74cb401bd7797eee9b4ee2031c778ec1418a0sha512: 4ca69f629f3889db98b0508c5f4f18b2cce41052cae060444158bbe178699d99caa471dfd2ffd4591fb7e587ad9692b41565e6eab59f827b2697582bef8ea62bssdeep: 12288:cQqLQ+CZC1UkAbXETBaFhmrMY3CpLSBeNMphURQqQW:cQ8QOUzXETBKAM3pLS8NMxWtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BDF423537528AC50C03F6970A07B54C4F15FBC3A2B9010556CEBBD883ABD6253D6E9ABsha3_384: c112c87e27e3b119faf7ae24f7839c97d536cdabb4dcb042e32da08b441f634dd8836806e13675b3ba8728b56f49ee5eep_bytes: b87ce24e005064ff3500000000648925timestamp: 2008-10-26 07:44:51
Version Info:
0: [No Data]

MemScan:Win32.Worm.Autorun.SY also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Obfuscated.l2p6
Elastic	malicious (high confidence)
MicroWorld-eScan	MemScan:Win32.Worm.Autorun.SY
CAT-QuickHeal	Worm.Lamin.A2
McAfee	Generic.cak
Malwarebytes	Sality.Virus.FileInfector.DDS
Zillya	Trojan.Obfuscated.Win32.62
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Worm:Win32/Obfuscated.a0dcfda7
K7GW	Trojan ( 0032d5a81 )
K7AntiVirus	Trojan ( 0032d5a81 )
Baidu	Win32.Worm.VB.rx
VirIT	Backdoor.Win32.Generic.ARIU
Cyren	W32/IrcBot.J.gen!Eldorado
Symantec	W32.Sality.AE
tehtris	Generic.Malware
ESET-NOD32	Win32/VB.NQG
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-34719
Kaspersky	Trojan.Win32.Obfuscated.whl
BitDefender	MemScan:Win32.Worm.Autorun.SY
NANO-Antivirus	Trojan.Win32.Crypt.ryquw
ViRobot	Trojan.Win32.Obfuscated.736768.T
Avast	Win32:Obfuscated-FTR [Trj]
Tencent	Win32.Trojan.Obfuscated.Cplw
Emsisoft	MemScan:Win32.Worm.Autorun.SY (B)
F-Secure	Worm.WORM/IRCBot.ms.70
DrWeb	Trojan.Minute
VIPRE	MemScan:Win32.Worm.Autorun.SY
TrendMicro	WORM_IRCBOT.BXN
McAfee-GW-Edition	BehavesLike.Win32.Infected.bh
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.8d330a213ac727c6
Sophos	W32/IRCBot-ADJ
Ikarus	Worm.Win32.Lamin
Jiangmin	Packed.Katusha.ook
Webroot	W32.Trojan.Obfuscated.Gen
Google	Detected
Avira	WORM/IRCBot.ms.70
Antiy-AVL	Trojan/Win32.Obfuscated
Microsoft	Worm:Win32/Lamin.A
Xcitium	TrojWare.Win32.Trojan.Obfuscated.whl0@1cd488
Arcabit	Win32.Worm.Autorun.SY
ZoneAlarm	Trojan.Win32.Obfuscated.whl
GData	MemScan:Win32.Worm.Autorun.SY
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R2513
VBA32	Trojan.Wacatac
ALYac	MemScan:Win32.Worm.Autorun.SY
MAX	malware (ai score=100)
Cylance	unsafe
Panda	W32/IrcBot.CKB.worm
TrendMicro-HouseCall	WORM_IRCBOT.BXN
Rising	Worm.Lamin!1.9A09 (CLASSIC)
Yandex	Trojan.GenAsa!wKh6AVAH5jU
SentinelOne	Static AI – Suspicious PE
MaxSecure	Virus.W32.Obfuscated.whl
Fortinet	W32/Generic.AC.74378!tr
BitDefenderTheta	AI:Packer.57FC770620
AVG	Win32:Obfuscated-FTR [Trj]
Cybereason	malicious.13ac72
DeepInstinct	MALICIOUS