Trojan • Worm

Trojan.AutoIt.Worm.A removal instruction

The Trojan.AutoIt.Worm.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.AutoIt.Worm.A virus can do?

Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.AutoIt.Worm.A?


File Info:
name: 8E097BADECF6A6B691FF.mlw
path: /opt/CAPEv2/storage/binaries/55f2d457bfea82e9b8f3d9489950614d0505b8319a4014978436c323bc28a1cd
crc32: FBC4F3ED
md5: 8e097badecf6a6b691ff43532200cbec
sha1: 571b072307086502a48ab809bea2e55f08f6a0b1
sha256: 55f2d457bfea82e9b8f3d9489950614d0505b8319a4014978436c323bc28a1cd
sha512: d58b709011ca2a1edb935718f405a9d0bd2c4f5420388f540a746302fb5cc29137310a8c732be8dfa94ba05bd96d850dbbb3b666cd024e9fa38302f6132978a8
ssdeep: 12288:YCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaIEkQ:YCdxte/80jYLT3U1jfsWaIEkQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15E058C2273DDC360CB769173BF69B7016EBF78650630B85B2F880D79A950171262DBA3
sha3_384: ed28948294916b216014a997721d8e225bb31d28827715c82c94406340fdbdabe3fe77b8b5cd9d613e38e1422500e679
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2023-07-24 16:16:54

Version Info:
CompanyName: hZCuOQuLu
FileVersion: 0.0.0.0
Translation: 0x0809 0x04b0

Trojan.AutoIt.Worm.A also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Trojan.AutoIT.Agent.TO
CAT-QuickHeal	Trojan.AutoIt.Worm.A
McAfee	Trojan-aitinject.af
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Trojan ( 0054bc841 )
K7GW	Trojan ( 0054bc841 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.MulDrop8.HPR
Cyren	W32/AutoIt.SQ.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Autoit.OGC
APEX	Malicious
Kaspersky	UDS:Trojan.Script.Generic
BitDefender	Trojan.AutoIT.Agent.TO
MicroWorld-eScan	Trojan.AutoIT.Agent.TO
Avast	AutoIt:Runner-BG [Trj]
Sophos	Mal/Generic-R
F-Secure	Worm.WORM/FakeExt.Gen8
DrWeb	Trojan.Starter.7878
VIPRE	Trojan.AutoIT.Agent.TO
McAfee-GW-Edition	BehavesLike.Win32.DropperAutoIt.ch
Emsisoft	Trojan.AutoIT.Agent.TO (B)
GData	Trojan.AutoIT.Agent.TO (2x)
Webroot	W32.Malware.gen
Avira	WORM/FakeExt.Gen8
Antiy-AVL	GrayWare/Autoit.WorkingDir.a
Xcitium	TrojWare.Win32.Autoit.OGH@8hon62
Arcabit	Trojan.AutoIT.Agent.TO [many]
ZoneAlarm	UDS:Trojan.Script.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win32.Starter.R241379
ALYac	Trojan.AutoIT.Agent.TO
MAX	malware (ai score=80)
Cylance	unsafe
Panda	Trj/CI.A
Ikarus	Trojan.Win32.Autoit
MaxSecure	Trojan.Malware.300983.susgen
AVG	AutoIt:Runner-BG [Trj]
Cybereason	malicious.decf6a
DeepInstinct	MALICIOUS

How to remove Trojan.AutoIt.Worm.A?

Trojan.AutoIt.Worm.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X