Should I remove “Win32/Autoit.PU”?

The Win32/Autoit.PU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Autoit.PU virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics

How to determine Win32/Autoit.PU?


File Info:
name: 9E031272FD767A9B559D.mlw
path: /opt/CAPEv2/storage/binaries/6717d2cb37ca1ed34eec011dc98a66cfbf8b70d2a3b9ebb9a6e888cab9b868eb
crc32: A277F291
md5: 9e031272fd767a9b559d1d8f182a93d4
sha1: 7a7bebbce112e74d97212a426b7203d84919b6dc
sha256: 6717d2cb37ca1ed34eec011dc98a66cfbf8b70d2a3b9ebb9a6e888cab9b868eb
sha512: 0e84ceb0805f9170d0bfa2524a20217959fb0b05c30a9afbc8cb1c52269589f1a89748e73308cda574cb7d36b9d1db7541ddd1beef61cd515d19e08edf258070
ssdeep: 12288:DhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNlk:JRmJkcoQricOIQxiZY1WNlk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T121D49F21B5C69036C2B323B19E7EF76A9A3D79360336D19727C82D315EA05816B39733
sha3_384: c0fb8875fb5706a4d27685e19defe28c2dd2e72ca5ad8f7f1b9e22e7e73bf4c4ff028f242526fac5bc25986359b5f92d
ep_bytes: e816900000e989feffffcccccccccc55
timestamp: 2012-01-29 21:32:28

Version Info:
FileDescription: 
FileVersion: 3, 3, 8, 1
CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
Translation: 0x0809 0x04b0

Win32/Autoit.PU also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Strictor.104585
CAT-QuickHeal	Trojan.Skeeyah.S1830840
Skyhigh	BehavesLike.Win32.DownloaderAutoIt.jh
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Strictor.104585
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000111 )
BitDefender	Gen:Variant.Strictor.104585
K7GW	Trojan ( 700000111 )
Cybereason	malicious.ce112e
Symantec	Bloodhound.Malautoit
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Autoit.PU
APEX	Malicious
Cynet	Malicious (score: 100)
Rising	Malware.FakeFolder/ICON!1.6AA9 (CLASSIC)
Sophos	Mal/Sohana-A
F-Secure	Dropper.DR/AutoIt.Gen
Baidu	Win32.Trojan.AutoIt.a
Emsisoft	Gen:Variant.Strictor.104585 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Strictor.104585
Google	Detected
Avira	DR/AutoIt.Gen
Antiy-AVL	Trojan/Win32.Autoit
Kingsoft	malware.kb.a.933
Xcitium	TrojWare.Win32.Agent.AZAB@59q48x
Arcabit	Trojan.Strictor.D19889
Varist	W32/AutoIt.AQ2.gen!Eldorado
AhnLab-V3	Trojan/Win.Rootkit.R574020
ALYac	Gen:Variant.Strictor.104585
TACHYON	Trojan/W32.Agent.629994
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/CI.A
Tencent	Trojan.Win32.Agent.hab
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Autoit.AZA
Fortinet	W32/Autoit.NLQ!tr
AVG	FileRepMalware [Drp]
Avast	FileRepMalware [Drp]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Win32/Autoit.PU?

Win32/Autoit.PU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X