Win32/AutoRun.AntiAV.T removal

The Win32/AutoRun.AntiAV.T is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/AutoRun.AntiAV.T virus can do?

Sample contains Overlay data
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/AutoRun.AntiAV.T?


File Info:
name: 7CD6BBB1103620C3AC56.mlw
path: /opt/CAPEv2/storage/binaries/508f6105ab036af504e7ed5243d1ec74cfd488125ec405075b604377bbd14ffb
crc32: 80357896
md5: 7cd6bbb1103620c3ac5602988ff167ec
sha1: 5b0baf51db37b624d39949799026f30974b52c32
sha256: 508f6105ab036af504e7ed5243d1ec74cfd488125ec405075b604377bbd14ffb
sha512: ae87d86a30957de708218c944274b2f6db996ae6b175ecff6ab7a48940d832b265af374dcf21f0421e391a382e7c6ef2beabde6bbd765e07513175d224b39a11
ssdeep: 12288:oQJxsPEqUt2EnouCSpQNxDIBuOFe7/uT:oQJxsP1g2VtIoOFdT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T168A4CE327B429033CB9204315DFA67BA19ADAD750F3497C7E3906F2A39385D2AA35353
sha3_384: 8be6e23e0f8d924508ff2c5e792deb646db4bbba1b07c48116960a78518e469e5337371d4f1cf01f3b5a3f03bfd96b7c
ep_bytes: e87b050000e936feffffcccccccccccc
timestamp: 2020-04-03 11:30:02

Version Info:
CompanyName: 360.cn
FileDescription: 360安全卫士 系统修复图标扫描模块
FileVersion: 1, 0, 0, 1047
InternalName: 360DeskAna.exe
LegalCopyright: (C) 360.cn Inc. All Rights Reserved.
OriginalFilename: 360DeskAna.exe
ProductName: 360安全卫士
ProductVersion: 1, 0, 0, 1047
Translation: 0x0804 0x04b0

Win32/AutoRun.AntiAV.T also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Bototer.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.8580
ClamAV	Win.Worm.Allaple-221772
FireEye	Generic.mg.7cd6bbb1103620c3
CAT-QuickHeal	TrojanDropper.Jadtre.B7
McAfee	W32/Fujacks.cm
Cylance	unsafe
VIPRE	Gen:Variant.Doina.8580
Sangfor	Suspicious.Win32.Save.ins
Alibaba	TrojanDropper:Win32/Bototer.f2d56189
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.36318.Cu3@a0pfkTnj
Cyren	W32/Risk.MODP-1101
Symantec	W32.Fujacks.CE!inf
ESET-NOD32	Win32/AutoRun.AntiAV.T
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Dropper.Win32.Bototer.bff
BitDefender	Gen:Variant.Doina.8580
NANO-Antivirus	Trojan.Win32.WowSub.etjuvq
Avast	Win32:AutoRun-BFB [Trj]
Tencent	Trojan.Win32.Downloader.aav
Emsisoft	Gen:Variant.Doina.8580 (B)
Baidu	Win32.Virus.Wapomi.a
F-Secure	Malware.W32/Diliman.B
DrWeb	Win32.WowSub.4
Zillya	Worm.Allaple.Win32.2
TrendMicro	PE_DOWN.A-O
McAfee-GW-Edition	W32/Fujacks.cm
Sophos	Mal/Jadtre-C
Ikarus	Rootkit.Win32.Agent
GData	Gen:Variant.Doina.8580 (2x)
Jiangmin	Heur:TrojanDownloader.Agent
Avira	W32/Diliman.B
Antiy-AVL	Worm[Net]/Win32.Allaple.gen
Xcitium	TrojWare.Win32.TrojanDownloader.Agent.~d057@1pf9bs
Arcabit	Trojan.Doina.D2184 [many]
ZoneAlarm	UDS:Trojan-Dropper.Win32.Bototer.bff
Microsoft	Trojan:Win32/Vindor!pz
Google	Detected
VBA32	BScope.Trojan.SvcHorse.01643
ALYac	Gen:Variant.Doina.8580
MAX	malware (ai score=82)
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/CI.A
TrendMicro-HouseCall	PE_DOWN.A-O
Rising	Worm.AutoRun!8.50 (CLOUD)
Yandex	Trojan.GenAsa!Ju64OpijAdY
MaxSecure	Virus.W32.Bototer.A
Fortinet	W32/Wapomi.AO
AVG	Win32:AutoRun-BFB [Trj]
Cybereason	malicious.110362
DeepInstinct	MALICIOUS

How to remove Win32/AutoRun.AntiAV.T?

Win32/AutoRun.AntiAV.T removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X