Trojan

VHO:Trojan-Dropper.Win32.VB removal guide

Malware Removal

The VHO:Trojan-Dropper.Win32.VB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What VHO:Trojan-Dropper.Win32.VB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Yara detections observed in process dumps, payloads or dropped files

How to determine VHO:Trojan-Dropper.Win32.VB?


File Info:

name: A03FEA94C057775E51CB.mlw
path: /opt/CAPEv2/storage/binaries/09c180a852bb2c2b13b369153af795b5644756d19e8856e6f4dcba9049b58ba8
crc32: 4068DAAD
md5: a03fea94c057775e51cb38355016c1f8
sha1: 85a21be04b63ea1dcfacd808bd0e769cdd78c8c4
sha256: 09c180a852bb2c2b13b369153af795b5644756d19e8856e6f4dcba9049b58ba8
sha512: f33eadd05340aca1ed919031ba0dee840f399cd8ea1ceacf306d9a257d795c2c21cad4d07aa65c05d6627c74844ea1bbbe67b7c7f9332875b17e8e25240a2680
ssdeep: 384:0KsGd/Tltt1axvn0Ip6q50CNLmyy0uljjjjNTzzLdZ9TjjjjjjjjjjjjjjjjjjTt:0Stt1a7xXCy1Ae
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DE82494FEA4C60E6D9998034619BD22F71D0B02C0B3AAB1675BCBE35F613763B617312
sha3_384: 28b3e293facb1eb476e38ccd2ea30fb56ee160162535109a7a1ff55c99c6ad0bbab270da8d51d6fb003db6fdcea1b85f
ep_bytes: 60be00b041008dbe0060feff5783cdff
timestamp: 2024-01-02 14:51:55

Version Info:

Translation: 0x0409 0x04b0
CompanyName: Дом
ProductName: Project1
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Dw_TU_2
OriginalFilename: Dw_TU_2.exe

VHO:Trojan-Dropper.Win32.VB also known as:

BkavW32.AIDetectMalware
SkyhighBehavesLike.Win32.PolyPatch.lh
MalwarebytesMachineLearning/Anomalous.97%
CrowdStrikewin/malicious_confidence_70% (D)
Elasticmalicious (moderate confidence)
APEXMalicious
CynetMalicious (score: 100)
KasperskyVHO:Trojan-Dropper.Win32.VB.gen
Trapminesuspicious.low.ml.score
FireEyeGeneric.mg.a03fea94c057775e
WebrootW32.Malware.Gen
GoogleDetected
Kingsoftmalware.kb.b.886
MicrosoftTrojan:Win32/Wacatac.B!ml
ZoneAlarmVHO:Trojan-Dropper.Win32.VB.gen
Cylanceunsafe
RisingDropper.VB!8.B2E (CLOUD)
IkarusTrojan.SuspectCRC
DeepInstinctMALICIOUS

How to remove VHO:Trojan-Dropper.Win32.VB?

VHO:Trojan-Dropper.Win32.VB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment