Categories: Malware

W32/AutoIt-QA removal guide

The W32/AutoIt-QA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32/AutoIt-QA virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to masquerade or mimic a legitimate process or file name
Attempts to modify Explorer settings to prevent file extensions from being displayed
Attempts to modify Explorer settings to prevent hidden files from being displayed
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine W32/AutoIt-QA?


File Info:
name: 97436628446E66450E2D.mlwpath: /opt/CAPEv2/storage/binaries/b92f83b56e523e82a6d1e3522f05b85e005733490e49dcce6d62e63503fbf2facrc32: CD47023Bmd5: 97436628446e66450e2dee0cdec37e55sha1: fafb69c518bbce912e941c8174ce870b7edf593csha256: b92f83b56e523e82a6d1e3522f05b85e005733490e49dcce6d62e63503fbf2fasha512: 46d00acd5e64eae71870320de4b34549e462dbfe58676a6326fd3792dfb6400cc89452d02157f9763260ccbab2de8eba257e103da740d107991cf7c3b6b74312ssdeep: 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYB:v6Wq4aaE6KwyF5L0Y2D1PqL4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A86413EA72A4F901D8B80272FA930381C1E07931AB78DB7BB1506A172CAF0156D6B75Dsha3_384: 56fb1d771ee473d54d1a93805109c6e987dd638d94ab9eb4a6dc14ba9f5b3350f000e731af7b9d328d49f0d0c87e9253ep_bytes: 60be007047008dbe00a0f8ff57eb0b90timestamp: 2012-01-29 21:32:28
Version Info:
FileDescription: FileVersion: 3, 3, 8, 1CompiledScript: AutoIt v3 Script: 3, 3, 8, 1Translation: 0x0809 0x04b0

W32/AutoIt-QA also known as:

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.Generic.lXua
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.Generic.8121236
FireEye	Trojan.Generic.8121236
CAT-QuickHeal	Trojan.AutoIt.Pistolar.A
Skyhigh	BehavesLike.Win32.Suspicious.fc
McAfee	Autoit.Dropper.gen.a
Cylance	unsafe
Zillya	Trojan.AutoIT.Win32.184317
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Pistolar.48e
K7GW	Trojan ( 700000111 )
K7AntiVirus	Trojan ( 700000111 )
Arcabit	Trojan.Generic.D7BEB94
BitDefenderTheta	AI:Packer.05DA809615
VirIT	Trojan.Win32.Autoit.ES
Symantec	W32.SillyFDC
ESET-NOD32	Win32/Autoit.HZ
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Autoit-6981134-0
Kaspersky	Trojan.Win32.Autoit.blz
BitDefender	Trojan.Generic.8121236
NANO-Antivirus	Trojan.Script.AutoIt.dbycns
Avast	AutoIt:Agent-DP [Trj]
Rising	Dropper.Pistolar/Autoit!1.A603 (CLASSIC)
Emsisoft	Trojan.Generic.8121236 (B)
Baidu	AutoIt.Worm.Agent.a
F-Secure	Trojan.TR/Rogue.JH.7554630
DrWeb	BackDoor.IRC.Bot.3238
VIPRE	Trojan.Generic.8121236
TrendMicro	TROJ_GEN.R002C0CKG23
Trapmine	malicious.high.ml.score
Sophos	W32/AutoIt-QA
Ikarus	Worm.Win32.AutoIt
Jiangmin	Trojan.MSIL.Zapchast.ag
Varist	W32/AutoIt.AK.gen!Eldorado
Avira	TR/Rogue.JH.7554630
Antiy-AVL	Trojan[Dropper]/Script.Pistolar
Kingsoft	Win32.Trojan.Autoit.blz
Xcitium	TrojWare.Win32.Autoit.n@4p0xzq
Microsoft	TrojanDropper:Win32/Pistolar.AA!MTB
ZoneAlarm	Trojan.Win32.Autoit.blz
GData	Trojan.Generic.8121236
Google	Detected
AhnLab-V3	Win-Trojan/Autoit.305824
ALYac	Trojan.Generic.8121236
MAX	malware (ai score=86)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Autoit.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0CKG23
Tencent	Win32.Trojan.Autoit.Hplw
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Autoit.HZ!worm
AVG	AutoIt:Agent-DP [Trj]
Cybereason	malicious.518bbc
DeepInstinct	MALICIOUS