What is "W32.AutoRun.A5"? – Adware Reports

The W32.AutoRun.A5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32.AutoRun.A5 virus can do?

Executable code extraction
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Creates an autorun.inf file
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Unusual version info supplied for binary

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine W32.AutoRun.A5?


File Info:
crc32: CC1E173C
md5: beb0fff9e478e3ce59b9387ac24abae1
name: BEB0FFF9E478E3CE59B9387AC24ABAE1.mlw
sha1: 973cb99952dc5e21af8a0eefbf9ac000d91fa307
sha256: ab9f6316052bea85272d08812c3bcef13d1c605bfcb9572332c5cbc6b92ce726
sha512: 60a4206b9ab7221b39a5c9742b3d3735d06aa03323bccb7fd097a7b92c6b6fa590520ce864e6c0853a6d5d2edd5b3e90c2168671f0b3f78a427b8bb624cf0952
ssdeep: 49152:/agnTOJagnTOO2bljB/4MnYYJ2ZhqSGLHkJEMy:TkIDQy
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
Translation: 0x0804 0x04b0
LegalCopyright: Microsoft
InternalName: Firewall
FileVersion: 1.00.0007
CompanyName: Xiang Corporation
LegalTrademarks: Microsoft Firewall
Comments: Microsoft Firewall
ProductName: Microsoft Firewall
ProductVersion: 1.00.0007
FileDescription: Microsoft Firewall
OriginalFilename: Firewall.exe

W32.AutoRun.A5 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
ClamAV	Win.Ransomware.WannaCry-9856297-0
CAT-QuickHeal	W32.AutoRun.A5
Malwarebytes	VB.Virus.FileInfector.DDS
K7AntiVirus	Virus ( 0040f57d1 )
K7GW	Trojan ( 00558d391 )
Cybereason	malicious.9e478e
Symantec	W32.Pajetbin
APEX	Malicious
Cynet	Malicious (score: 100)
MicroWorld-eScan	Gen:Trojan.Heur.0v3@sqWg5Sbb
Ad-Aware	Gen:Trojan.Heur.0v3@sqWg5Sbb
VIPRE	Trojan.Win32.Generic.pak!cobra
Emsisoft	Gen:Trojan.Heur.0v3@sqWg5Sbb (B)
Jiangmin	Worm.AutoRun.bnt
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASBOL.406A
Kingsoft	Heur.SSC.2786629.1216.(kcloud)
AhnLab-V3	Trojan/Win32.Vindor.C2471776
Acronis	suspicious
TACHYON	Banker/W32.Banbra.Gen
TrendMicro-HouseCall	WORM_AUTORUN.BTM
Tencent	Worm.Win32.AutoRun.acc
Yandex	Trojan.GenAsa!g8z8LT30jj4
SentinelOne	Static AI – Malicious PE
Fortinet	W32/AutoRun.RPV!worm
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove W32.AutoRun.A5?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “W32.AutoRun.A5”?