VHO:Trojan.Win32.Nobady removal

The VHO:Trojan.Win32.Nobady is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VHO:Trojan.Win32.Nobady virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Executed a command line with /V argument which modifies variable behaviour and whitespace allowing for increased obfuscation options
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Anomalous binary characteristics

How to determine VHO:Trojan.Win32.Nobady?

File Info:
name: 0C9949129E57E7DF19B3.mlw
path: /opt/CAPEv2/storage/binaries/6530cdb9377f2cad93c95c1ad92972b11dcc4bfbd6cb2a831f4d97031787bac3
crc32: 47B69ACA
md5: 0c9949129e57e7df19b3ace01203986c
sha1: afad32bbdcaee89783756694fd43a6c0c127e57b
sha256: 6530cdb9377f2cad93c95c1ad92972b11dcc4bfbd6cb2a831f4d97031787bac3
sha512: d5e8cefcb0a87f915e04d117df56cd91069e222ac57a8a59f2f5b08aa692179ddd91cac7b8aa1bd44ac3d6e97c2ab717ab92417889450d377151359c26e9943d
ssdeep: 3072:hrVTLpDFF60ghnzsG03d4PbW4YzfUe5Jfkdn1Nu994pLthEjQT65:hrVnpDiDzsG+Ii48U8fkpOkEjP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17F247C017791C257D2A369366ED2D258DBBA3DB24F3E831BFD447B0E28B26906CD0B15
sha3_384: ac54c8a07b9b4b60428bbcb475cdee699328ec709899ea05ad65d70401b52c7dcb35081f9b252949899324d99d6b9e14
ep_bytes: 60ba000000008aba0010400080c77c88
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

VHO:Trojan.Win32.Nobady also known as:

How to remove VHO:Trojan.Win32.Nobady?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.