Trojan:Win32/Vundo!BI removal guide

The Trojan:Win32/Vundo!BI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Vundo!BI virus can do?

Behavioural detection: Executable code extraction – unpacking
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:Win32/Vundo!BI?


File Info:
name: A70FFA3776C61D8A890D.mlw
path: /opt/CAPEv2/storage/binaries/7f91a43557d2fdd1390a346b2a422a0a18e9c334c7eae32ca9d63ef292e2f8b0
crc32: 514EC82A
md5: a70ffa3776c61d8a890dc3aa9ae6ac16
sha1: 44ca4b839923b6844e17d49ce53c46ada04b3a1d
sha256: 7f91a43557d2fdd1390a346b2a422a0a18e9c334c7eae32ca9d63ef292e2f8b0
sha512: 0d1fe0f5d9c1b768fac8bf94cbfa5b31b3ef409c09825c11c0e5586834a7fb80c73779537252448921ae5e2ac6e7a261a829fa0b13e1a1c14d0a86d332a7c4f8
ssdeep: 1536:ix3nCZkUg4Gqtl/YCW7sSCWLzJDZ7c2/HjmyvBaD6cUqUREr94xQi00VEBW:yCZg4GUuX7sSCWLRZ77/jm0q6cUqYEri
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1E683010A23DB452FDD2B707FE56A1048B292493B4F84014FEBD58C4645C9AED29E9CBE
sha3_384: 65f38931cad490b51845902a13fec6831d6c0164a9dd8502ac3e78dc4e05db045246a561cb2595d34f05155483f54c00
ep_bytes: 506870430210e93703000053578b7c30
timestamp: 2008-05-08 19:24:21

Version Info:
0: [No Data]

Trojan:Win32/Vundo!BI also known as:

Bkav	W32.AIDetectMalware
Lionic	Hacktool.Win32.Krap.ldVw
Elastic	malicious (high confidence)
DrWeb	Trojan.Virtumod.1771
MicroWorld-eScan	MemScan:Trojan.Vundo.GPD
FireEye	Generic.mg.a70ffa3776c61d8a
Skyhigh	BehavesLike.Win32.Vundo.mc
ALYac	MemScan:Trojan.Vundo.GPD
Cylance	unsafe
Zillya	Trojan.Migotrup.Win32.77
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:Win32/Virtumonde.029ac375
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	AI:Packer.12F916BD1E
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.ADK
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	MemScan:Trojan.Vundo.GPD
NANO-Antivirus	Trojan.Win32.Plapon.bleub
Avast	Win32:JunkPoly [Cryp]
Tencent	Win32.Trojan.Generic.Cujl
TACHYON	Trojan/W32.Migotrup.84992.BL
Emsisoft	MemScan:Trojan.Vundo.GPD (B)
F-Secure	Trojan.TR/ATRAPS.Gen2
VIPRE	MemScan:Trojan.Vundo.GPD
TrendMicro	TROJ_VUNDO.ILYS
Sophos	Troj/Virtum-Gen
Ikarus	Virus.Win32.Vundo
Jiangmin	Trojan/Migotrup.bj
Webroot	W32.Malware.Gen
Varist	W32/Virtumonde.BK.gen!Eldorado
Avira	TR/ATRAPS.Gen2
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	Win32.Trojan.Generic.a
Microsoft	Trojan:Win32/Vundo.gen!BI
Xcitium	TrojWare.Win32.PkdKrap.Q@1j8qvd
Arcabit	Trojan.Vundo.GPD
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	MemScan:Trojan.Vundo.GPD
Google	Detected
AhnLab-V3	Win-Trojan/Virtumonde.Gen2
McAfee	Vundo.gen.bh
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Virtumod
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_VUNDO.ILYS
Rising	Trojan.Kryptik!1.9990 (CLASSIC)
Yandex	Trojan.GenAsa!uU89i88+FJ0
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:JunkPoly [Cryp]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Vundo!BI?

Trojan:Win32/Vundo!BI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X