Categories: Malware

Win32/AutoRun.VB.AVM removal tips

The Win32/AutoRun.VB.AVM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/AutoRun.VB.AVM virus can do?

Behavioural detection: Executable code extraction – unpacking
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
Unconventionial language used in binary resources: Sindhi
Authenticode signature is invalid
Behavioural detection: Injection (inter-process)
Attempts to disable Windows Auto Updates
Anomalous binary characteristics
Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Win32/AutoRun.VB.AVM?


File Info:
name: 5406AD2AA5FDD2BD09B5.mlwpath: /opt/CAPEv2/storage/binaries/f9c7d376d0dfb476d87d0c9c0605284c95663567afd79a3fdf46a0811dc70b02crc32: 4195F51Fmd5: 5406ad2aa5fdd2bd09b5231e80b82615sha1: aa547e0407ce1847c6389bf7a741591fdee0754asha256: f9c7d376d0dfb476d87d0c9c0605284c95663567afd79a3fdf46a0811dc70b02sha512: 5498a834761ee0045c6c216780f131fc1f216bdddfe34f946296b7b6e7957aab010ea778e5f7169219fd06e309a226d0a7923f964314cdbe3a3083389ec82191ssdeep: 6144:Fm+3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/ASb:FmsPhAmZIH+A6type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12B34C7677F619848F43A15F459F3C3F21696E84DCA47420B5B303A2A2EFBE461D246B3sha3_384: 4b62396ac05f53f2414884445fc6b552f3e4951e15bc35fc65129da471617ec7f039ee60e9530f3b556cd661c6b70293ep_bytes: 68a0124000e8f0ffffff000000000000timestamp: 2012-05-03 05:51:34
Version Info:
Translation: 0x0409 0x04b0ProductName: mjszfokcuiqFileVersion: 7.08.0002ProductVersion: 7.08.0002InternalName: rmhadbvhszOriginalFilename: rmhadbvhsz.exe

Win32/AutoRun.VB.AVM also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKDZ.95863
FireEye	Generic.mg.5406ad2aa5fdd2bd
CAT-QuickHeal	Trojan.Beebone.D
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.GenericKDZ.95863
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	EmailWorm ( 003c363a1 )
K7GW	EmailWorm ( 003c363a1 )
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Worm.VB.aq
VirIT	Trojan.Win32.VBCrypt.EVL
Symantec	W32.Changeup
Elastic	malicious (high confidence)
ESET-NOD32	Win32/AutoRun.VB.AVM
APEX	Malicious
TrendMicro-HouseCall	WORM_VOBFUS.SMJ2
ClamAV	Win.Malware.Vobfus-9940378-0
Kaspersky	Worm.Win32.Vobfus.dgsd
BitDefender	Trojan.GenericKDZ.95863
NANO-Antivirus	Trojan.Win32.VB.rilqk
TACHYON	Worm/W32.Vobfus.233472.B
F-Secure	Trojan.TR/Barys.992.JH.2
DrWeb	Win32.HLLW.Autoruner1.15339
TrendMicro	WORM_VOBFUS.SMJ2
Trapmine	malicious.high.ml.score
Sophos	W32/SillyFD-W
Ikarus	Trojan.Win32.Vobfus
Jiangmin	Trojan/Generic.atfxu
Varist	W32/Vobfus.O.gen!Eldorado
Avira	TR/Barys.992.JH.2
Kingsoft	malware.kb.a.996
Xcitium	TrojWare.Win32.VB.AVA@4paxk7
Arcabit	Trojan.Generic.D17677
ViRobot	Trojan.Win32.A.VB.233472.N
ZoneAlarm	Worm.Win32.Vobfus.dgsd
GData	Trojan.GenericKDZ.95863
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.VB.R24513
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZevbaF.36802.om0@a4EtMPfO
MAX	malware (ai score=86)
VBA32	SScope.Malware-Cryptor.VBCR.3042
Cylance	unsafe
Tencent	Worm.Win32.Vobfus.n
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/VBObfus.AU!tr
Cybereason	malicious.aa5fdd
Panda	W32/Vobfus.GEW.worm
alibabacloud	Trojan:Win/Vobfus.b417f181