Trojan

Trojan.Win32.VB.enm removal guide

Malware Removal

The Trojan.Win32.VB.enm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.VB.enm virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • CAPE detected the shellcode patterns malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Win32.VB.enm?


File Info:

name: 8F9DBA5BA054A827D3DB.mlw
path: /opt/CAPEv2/storage/binaries/6d0ed05f5f2f94cb2520906b0b73a258e0b648841bbd551d1dd941f0bc98bb63
crc32: 70A63E15
md5: 8f9dba5ba054a827d3db4e03dcf61743
sha1: 689bec2f76954583cf803a3b02825ef27e1d5434
sha256: 6d0ed05f5f2f94cb2520906b0b73a258e0b648841bbd551d1dd941f0bc98bb63
sha512: bbe5fbe4ff5433d1283ba8da072d0f9335c9204ebdee383e696b31ab63ceefc60f814885497523d52fe2c83fefd494dd301b21feaff43b60ae5d5c0040494633
ssdeep: 1536:PiD5LttXP8x6l59XhDMfqu5WArMp4g88HaeEIc8J9O8uwdbK87awQM1Zv9HoULf0:PiVj/n1Y4p4gMRIO8uwBKEQ+cULflQnp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10D044A12F7E48031E5B3067198B9D6259A3AFC21CB31C02A77C4B94E2D71BD1A677B27
sha3_384: e911e0f1d9b9550b963330cf77bd0b415dddc90fc7493929f0d96af43c5c365318b00840c2aff9a6f0c2a0d4ba915fab
ep_bytes: 60be006040008dbe00b0ffff57eb0b90
timestamp: 2008-06-01 21:58:02

Version Info:

0: [No Data]

Trojan.Win32.VB.enm also known as:

BkavW32.AIDetectMalware
Elasticmalicious (moderate confidence)
MicroWorld-eScanTrojan.VB.Autorun.AF
FireEyeGeneric.mg.8f9dba5ba054a827
CAT-QuickHealTrojan.AgentMF.S26355867
SkyhighBehavesLike.Win32.Generic.cm
McAfeeW32/Autorun.worm.ie
MalwarebytesGeneric.Malware.AI.DDS
ZillyaTrojan.VB.Win32.1814985
SangforTrojan.Win32.Save.a
K7AntiVirusEmailWorm ( 005327171 )
K7GWEmailWorm ( 005327171 )
BaiduWin32.Worm.VB.g
SymantecW32.Bluven
tehtrisGeneric.Malware
ESET-NOD32a variant of Win32/AutoRun.VB.AMP
APEXMalicious
AvastWin32:Evo-gen [Trj]
ClamAVWin.Malware.Score-6830630-0
KasperskyTrojan.Win32.VB.enm
BitDefenderTrojan.VB.Autorun.AF
NANO-AntivirusTrojan.Win32.VB.cqkxjh
TencentWorm.Win32.Autorun.aar
EmsisoftTrojan.VB.Autorun.AF (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.Siggen3.63843
VIPRETrojan.VB.Autorun.AF
SophosTroj/VBDrpB-Gen
IkarusWorm.Win32.AutoRun
JiangminTrojan/VB.ckgb
GoogleDetected
AviraTR/Dropper.Gen
VaristW32/FakeDoc.CE.gen!Eldorado
Antiy-AVLTrojan/Win32.VB
Kingsoftmalware.kb.b.984
MicrosoftTrojan:Win32/Vindor!pz
XcitiumWorm.Win32.Autorun.h0@143j1r
ArcabitTrojan.VB.Autorun.AF
ViRobotTrojan.Win32.VB.113692[UPX]
ZoneAlarmTrojan.Win32.VB.enm
GDataTrojan.VB.Autorun.AF
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.VB.R644264
Acronissuspicious
BitDefenderThetaAI:Packer.323D5EF21D
ALYacTrojan.VB.Autorun.AF
VBA32Trojan.VB
Cylanceunsafe
PandaTrj/Genetic.gen
RisingMalware.FakeXLS/ICON!1.9C3D (CLASSIC)
MAXmalware (ai score=87)
FortinetW32/VB.ENM!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS

How to remove Trojan.Win32.VB.enm?

Trojan.Win32.VB.enm removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment