UDS:Worm.Win32.Mabezat.b removal

The UDS:Worm.Win32.Mabezat.b is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What UDS:Worm.Win32.Mabezat.b virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid
Anomalous binary characteristics

How to determine UDS:Worm.Win32.Mabezat.b?


File Info:
name: 929DF65E4FC0A4933249.mlw
path: /opt/CAPEv2/storage/binaries/de7b27808e5de380fb9cc23e7cdb074fe9c30b82c28511eaae5914c04e47273f
crc32: CB8B9BF7
md5: 929df65e4fc0a4933249bc90af6b3fee
sha1: 1f549a2d7b5c26eecaf8d7e924a337edf9ac6515
sha256: de7b27808e5de380fb9cc23e7cdb074fe9c30b82c28511eaae5914c04e47273f
sha512: 9fcdf5f5e7bc7e535f50a25919e038c18eeb8da6fd808efd98e35a737a4600e64af631973d4c4c814b497f1d16dc03b0135ce2427947db38a23b160fcf14d9e1
ssdeep: 98304:xfmE8TGowiqNIqlzYRo4cNFuxLtkBSNQdw2A17nfJxe4qPJTtk72z4iqh5hR7aRD:xmT7Oli6krgRUcH3Qx2U9AyDyF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1098659233FC5C8B6E6730332C9B8E7B891FAF970A8F1451B7694632E1F704415A19E66
sha3_384: 1218c1c1c606fce9c869db6e68b9be2bcb9bed5d8920798bcdc44e8dedcc262685cf9c29e8160b69c3b1f98fbd6575c0
ep_bytes: e849f4ffffe986faffff6a1468f0cd94
timestamp: 2012-09-29 17:46:05

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft SkyDrive Pro
FileVersion: 15.0.4420.1017
InternalName: Groove
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: Groove.exe
ProductName: Microsoft Office 2013
ProductVersion: 15.0.4420.1017
Translation: 0x0000 0x04e4

UDS:Worm.Win32.Mabezat.b also known as:

Lionic	Worm.Win32.Mabezat.o!c
FireEye	Generic.mg.929df65e4fc0a493
Sangfor	Worm.Win32.Mabezat.V47l
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
APEX	Malicious
TrendMicro-HouseCall	TROJ_GEN.R002H07IN22
Kaspersky	UDS:Worm.Win32.Mabezat.b
Avast	Win32:Agent-AVCE [Trj]
McAfee-GW-Edition	Artemis!Trojan
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	GenericRXAA-AA!929DF65E4FC0
VBA32	BScope.Worm.Mabezat
Cylance	Unsafe
Rising	Worm.Mabezat!8.16D6 (CLOUD)
Fortinet	PossibleThreat.PALLAS.M
AVG	Win32:Agent-AVCE [Trj]

How to remove UDS:Worm.Win32.Mabezat.b?

UDS:Worm.Win32.Mabezat.b removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X