VirTool:Win32/Obfuscator.AHO removal

The VirTool:Win32/Obfuscator.AHO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/Obfuscator.AHO virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)

How to determine VirTool:Win32/Obfuscator.AHO?

File Info:
name: 91EDAF5E33356A73C616.mlw
path: /opt/CAPEv2/storage/binaries/f11e69d139a2312c70ab2be6aa40abd1ec7d049412413115137fa83162b51bd5
crc32: 29B35A44
md5: 91edaf5e33356a73c616168325092274
sha1: 49a5580aad3836f58d7d69fc89386c49439042c5
sha256: f11e69d139a2312c70ab2be6aa40abd1ec7d049412413115137fa83162b51bd5
sha512: 0e32d807316313e0265f248cc679f484a03404de41e125cea1deac991c195e1f9868b798884bd4d8523ac9839dca6ce52c9fc8f60cc7d932b54a6160435c9219
ssdeep: 3072:3JLekm30EFSYDTrLo0dvVBqaraVwEuT1uPJGcXYonBWapQbZLk36xBpzh8nFO9fv:3JKkm3rfZqvV9JGWohPxrzuFTV2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18534E00006D580B6E0BB99707D760AA1CD2EBC761A34584FB7C53B0FE871ADC67A365B
sha3_384: 275ebd9d9fa84a8e22d45224cbe1a239e4dc4c953dc597a45b3f3228c5e933d52ce531e636b36f90af85c2080f6c465d
ep_bytes: 558bec6aff6858ea400068140a400064
timestamp: 2013-06-20 16:00:20

Version Info:
Comments: 
CompanyName: 
FileDescription: aedbteyjntuiymnb
FileVersion: 60,80, 20, 31
InternalName: sdabtyrebnui,mk
LegalCopyright: Copyright (C) 2002
LegalTrademarks: 
OriginalFilename: sdhtyrgbrtbb.EXE
PrivateBuild: 
ProductName: sedahythtyj
ProductVersion: 60,80, 20, 31
SpecialBuild: 
Translation: 0x040c 0x03a4

VirTool:Win32/Obfuscator.AHO also known as:

How to remove VirTool:Win32/Obfuscator.AHO?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.