Vundo.4 removal

The Vundo.4 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Vundo.4 virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Vundo.4?


File Info:
name: 43FA4270CD1B5A17F061.mlw
path: /opt/CAPEv2/storage/binaries/26c8c6d3aaeefcad76d0e35b3e4df490f234b86548b4bfda26152b6d3bbfd7d5
crc32: F4B89210
md5: 43fa4270cd1b5a17f0617a68e0bb1cc0
sha1: f4b227a63ffee799c848075410e1dca764af79cd
sha256: 26c8c6d3aaeefcad76d0e35b3e4df490f234b86548b4bfda26152b6d3bbfd7d5
sha512: 3bebeda1a427cc9ffc62fde41ca6c8ed3a40912b7b06329e239fba3fbd25c1ad23e93d37c4e6a824a3efdd7130c0d452b8ceba11fd55c221dbc05bc9f1d74fe9
ssdeep: 1536:Km0AhPHKrj3gISt9dnTMiobanN9GAZ8LmsyfNRosDrPsmfbB+mqlJFgJA:KMPHKSnMi5nNgAune4mPnolJF+A
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T19C93BE427BE080F5C2A355308E26C377ABB5AE3198F25887B7E31D263D3A903D616617
sha3_384: 7575eac8761d101b4465b37c403cb9166d5851c2ab07bd92e83c84a83d6cb4b7cd0970fa5b3ab6fc0c676b86adaf94f6
ep_bytes: 558bec538b5d08568b750c578b7d1085
timestamp: 2003-09-23 10:46:57

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Script Client Side Extension
FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205)
InternalName: gpscript
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: gpscript.dll
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.0.6000.16386
Translation: 0x0409 0x04b0

Vundo.4 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Vundo.4
FireEye	Generic.mg.43fa4270cd1b5a17
Skyhigh	Artemis!Trojan
McAfee	Artemis!43FA4270CD1B
Cylance	unsafe
Zillya	Trojan.Injector.Win32.63189
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004908121 )
Alibaba	VirTool:Win32/Obfuscator.9ee1b88e
K7GW	Trojan ( 004908121 )
BitDefenderTheta	Gen:NN.ZedlaF.36744.fu8@a8ynm0ci
VirIT	Trojan.Win32.Generic.AYAX
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.NHV
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Vundo.4
NANO-Antivirus	Trojan.Win32.Vundo.cubij
Avast	Win32:MalOb-GD [Cryp]
Tencent	Win32.Trojan.Generic.Itgl
TACHYON	Trojan/W32.Menti.93184.C
Emsisoft	Gen:Variant.Vundo.4 (B)
F-Secure	Trojan.TR/Vundo.Gen
DrWeb	Trojan.Siggen2.58032
VIPRE	Gen:Variant.Vundo.4
Sophos	Mal/Generic-S
GData	Gen:Variant.Vundo.4
Jiangmin	Trojan/Genome.anlp
Webroot	W32.Trojan.Vundo.AV
Google	Detected
Avira	TR/Vundo.Gen
Antiy-AVL	Trojan/Win32.Menti
Kingsoft	Win32.Trojan.Generic.a
Xcitium	Malware@#18zedpsjfb0ar
Arcabit	Trojan.Vundo.4
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Vundo.SA
Varist	W32/Virtumonde.BZ.gen!Eldorado
VBA32	BScope.Trojan.Vundo
ALYac	Gen:Variant.Vundo.4
MAX	malware (ai score=100)
Panda	Trj/Genetic.gen
Rising	Malware.Undefined!8.C (TFE:5:DxhuP9fV21D)
Yandex	Trojan.Injector!JvRaCnTekBQ
Ikarus	Trojan.Win32.Pirminay
MaxSecure	Trojan.Malware.7022.susgen
Fortinet	W32/Kryptik.ANL!tr
AVG	Win32:MalOb-GD [Cryp]
DeepInstinct	MALICIOUS

How to remove Vundo.4?

Vundo.4 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X