Categories: Trojan

TrojanDropper:Win32/VB!pz removal tips

The TrojanDropper:Win32/VB!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/VB!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDropper:Win32/VB!pz?


File Info:
name: B9289A25C8EDEBE61564.mlwpath: /opt/CAPEv2/storage/binaries/99423eaeb9941c3630c7e558fad7e7bd563ed844fc4b5d0092ea26f0dc7698accrc32: 615E10F1md5: b9289a25c8edebe61564a25e6fa5a6b1sha1: 9bbd51ab31434c91510cf0e947098aadce47814fsha256: 99423eaeb9941c3630c7e558fad7e7bd563ed844fc4b5d0092ea26f0dc7698acsha512: e42ea8a1ec33d356b4c5d5fcf803bb04f3d5940237ff3fb6f1237350c71718912256e07f5b3895e04d32becbe1479235e2fcea82817877859ce2d5a838e6a27assdeep: 12288:oP6ys+NgzZhkDjhYwrVrQ2+3vxttXOh8ghy6lyH:cBNUfkjBSbteTltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EDB41233474A49A0F2738A710C271D36AE76FCB656014C436792FF1E9C72946AEE221Fsha3_384: 38c1f2399f4ab7c2100ab1978fa3c86f2f4e511f5ae0f85215ec93000f5130392b784bc59f4836df4e91671a47458b72ep_bytes: 6898154000e8eeffffff000000000000timestamp: 2011-03-16 01:20:13
Version Info:
0: [No Data]

TrojanDropper:Win32/VB!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.VBKrypt.4!c
DrWeb	Trojan.Click1.58730
MicroWorld-eScan	Gen:Variant.Fugrafa.67929
FireEye	Generic.mg.b9289a25c8edebe6
CAT-QuickHeal	TrojanDropper.VB.HV3
Skyhigh	BehavesLike.Win32.Generic.hc
ALYac	Gen:Variant.Fugrafa.67929
Cylance	unsafe
Zillya	Trojan.VBKrypt.Win32.62663
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan ( 0022f2c01 )
Alibaba	TrojanDropper:Win32/VBKrypt.01e994c1
K7GW	Trojan ( 0022f2c01 )
Cybereason	malicious.b31434
Arcabit	Trojan.Fugrafa.D10959
BitDefenderTheta	AI:Packer.7ED7847420
VirIT	Trojan.Win32.Generic.JVG
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDropper.VB.NRO
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.VB-1480
Kaspersky	Trojan.Win32.VBKrypt.bbro
BitDefender	Gen:Variant.Fugrafa.67929
NANO-Antivirus	Trojan.Win32.VBKrypt.dxohqe
Avast	Win32:Evo-gen [Trj]
Tencent	Trojan.Win32.Delf.pki
TACHYON	Trojan/W32.VB-VBKrypt.540672.Y
Emsisoft	Gen:Variant.Fugrafa.67929 (B)
F-Secure	Trojan.TR/Crypt.PEPM.Gen
Baidu	Win32.Trojan.VBKrypt.a
VIPRE	Gen:Variant.Fugrafa.67929
TrendMicro	TROJ_VBDROP.SMIA
Sophos	Mal/Generic-G
Ikarus	Trojan.Win32.Pasta
Jiangmin	Trojan/VBKrypt.hflk
Webroot	W32.Trojan.Dropper
Varist	W32/StartPage.AP.gen!Eldorado
Avira	TR/StartPage.MC.193
Antiy-AVL	Trojan[Dropper]/Win32.VB
Kingsoft	Win32.HeurC.KVM006.a
Xcitium	TrojWare.Win32.TrojanDropper.VB.NQT@26wk58
Microsoft	TrojanDropper:Win32/VB!pz
ViRobot	Trojan.Win32.A.VBKrypt.540672.F
ZoneAlarm	Trojan.Win32.VBKrypt.bbro
GData	Win32.Trojan.PSE.13LF282
Google	Detected
AhnLab-V3	Trojan/Win32.VBKrypt.R3560
McAfee	GenericRXAA-AA!B9289A25C8ED
MAX	malware (ai score=100)
VBA32	Trojan.VBRA.012478
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_VBDROP.SMIA
Rising	Trojan.VBEx!1.99EE (CLASSIC)
Yandex	Trojan.VBKrypt!c3P3S+F9qok
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1630594.susgen
Fortinet	W32/VBKrypt.NRO!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)