Malware

Win32/AutoRun.VB.AIY information

Malware Removal

The Win32/AutoRun.VB.AIY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/AutoRun.VB.AIY virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/AutoRun.VB.AIY?



File Info:

name: ACA9D7E691A93282CEDB.mlw
path: /opt/CAPEv2/storage/binaries/5e30f4e8d0569605cd3ff03a6f4e4b1a918cf2b85b23ed1095f8b68e7f58fe30
crc32: 5AA5ABB7
md5: aca9d7e691a93282cedbc4215b73f7f8
sha1: 6a0b31ece697846f71397a56b70bdbb68ede2f9f
sha256: 5e30f4e8d0569605cd3ff03a6f4e4b1a918cf2b85b23ed1095f8b68e7f58fe30
sha512: 8cc050a9e3e26f044df2e6746b251ad9fc0b9ab28a72e19bafd2c3c2956c04ff0b8b8e87ac26c08ac50e4890a034db55e133323215ea6e0a23d6ae9f10248c29
ssdeep: 3072:DmRiCROLcRT+i5/vwOV/FB671omXB1Gt878:DmRmART+i5rYo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T143D3A42E7790F67EC525C6F43D1A43A0907AAD3521D2AD03F7C61B1AB6F1EA78220747
sha3_384: 6d2544f87dc2e6fad986163cd6b7c45431f01f1c1459bcdc1170883412659e9de14c14808b0da6a16f25f27334b6ec61
ep_bytes: 68c8384000e8f0ffffff000000000000
timestamp: 2011-07-27 00:54:59


Version Info:

Translation: 0x0409 0x04b0
ProductName: clNfyzkMLSbBsSJFEGiO
FileVersion: 1.00
ProductVersion: 1.00
InternalName: lThbXLhJBHAg
OriginalFilename: lThbXLhJBHAg.exe

Win32/AutoRun.VB.AIY also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Inject.1b!c
AVGWin32:VB-WVF [Trj]
MicroWorld-eScanGen:Variant.VBKrypt.55
CAT-QuickHealTrojan.Vobfus.gen
McAfeeVBObfus.g
MalwarebytesMalware.AI.3139088351
SangforSuspicious.Win32.Save.vb
K7AntiVirusEmailWorm ( 0054d10f1 )
AlibabaMalware:Win32/km_2ff14.None
K7GWEmailWorm ( 0054d10f1 )
Cybereasonmalicious.691a93
BaiduWin32.Worm.VB.lk
VirITWorm.Win32.Generic.AVYA
CyrenW32/Vobfus.W.gen!Eldorado
SymantecW32.Changeup
Elasticmalicious (high confidence)
ESET-NOD32Win32/AutoRun.VB.AIY
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Changeup-6169544-0
KasperskyTrojan.Win32.Inject.bgnn
BitDefenderGen:Variant.VBKrypt.55
NANO-AntivirusTrojan.Win32.Inject.dxqgeq
AvastWin32:VB-WVF [Trj]
TencentWin32.Trojan.Inject.Jajl
EmsisoftGen:Variant.VBKrypt.55 (B)
F-SecureWorm.WORM/Vobfus.dazrc
DrWebTrojan.VbCrypt.60
VIPREGen:Variant.VBKrypt.55
TrendMicroMal_VBNA-7
McAfee-GW-EditionBehavesLike.Win32.VBObfus.cm
FireEyeGeneric.mg.aca9d7e691a93282
SophosW32/Vobfus-P
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.VBKrypt.55
AviraWORM/Vobfus.dazrc
MAXmalware (ai score=88)
Antiy-AVLWorm/Win32.WBNA.gen
XcitiumWorm.Win32.Vobfus.DG@5q5mo0
ArcabitTrojan.VBKrypt.55
ZoneAlarmTrojan.Win32.Inject.bgnn
MicrosoftWorm:Win32/Vobfus.DA
GoogleDetected
AhnLab-V3Trojan/Win32.VBKrypt.R19677
BitDefenderThetaAI:Packer.D62E527720
ALYacGen:Variant.VBKrypt.55
TACHYONTrojan/W32.VB-Inject.135168.O
VBA32BScope.Worm.VBNA
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallMal_VBNA-7
RisingWorm.VobfusEx!1.99E0 (CLASSIC)
YandexTrojan.GenAsa!XVzgbND7dao
IkarusWorm.Gamarue
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/VB.CNE!worm
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Win32/AutoRun.VB.AIY?

Win32/AutoRun.VB.AIY removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment