Win32/AutoRun.VB.ASB removal instruction

The Win32/AutoRun.VB.ASB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/AutoRun.VB.ASB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/AutoRun.VB.ASB?

File Info:
name: 29BECCFEE2355E3154E0.mlw
path: /opt/CAPEv2/storage/binaries/5d2dfb5efab74e15c041bedff4dfbcb2cad2ead7d8a12842d9102d1b8edc5b30
crc32: BC323116
md5: 29beccfee2355e3154e0ddce7dfbb039
sha1: 7106e6aa82bc0abafd78b95e3bbaab63733b0989
sha256: 5d2dfb5efab74e15c041bedff4dfbcb2cad2ead7d8a12842d9102d1b8edc5b30
sha512: 69e0d4850a19d48c579cd421e496fd97662bd2c9b30494a9f7cdee8a1a8bc1ed6034ec5b97f61722678f8b6a36a7734174b5c43c0134570f7e41f7c7894a27cf
ssdeep: 3072:mtAKE9tC8lsacWYCs5fDF4LJSImbV8UvR77D9G5UEDVR/bwutUqQJ8HN:m0tazbF4NN28UJ77hGGED/bbJt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC34A329B3A0E73EE065C7F829AA43A4446EBD3421E5B407F3D15A2576F1EF39221743
sha3_384: f0d792b6dec39fe5e232e60f95e4dee966ddd2a25f24931f69cd2e341abfbebbddbdcc7a34764cb5675143ff155cf7a7
ep_bytes: 688c584000e8eeffffff000000000000
timestamp: 2012-02-10 20:49:49

Version Info:
Translation: 0x0409 0x04b0
ProductName: CISYzv
FileVersion: 1.00
ProductVersion: 1.00
InternalName: cSwVzPXi
OriginalFilename: cSwVzPXi.exe

Win32/AutoRun.VB.ASB also known as:

How to remove Win32/AutoRun.VB.ASB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.