Categories: Malware

Win32/AutoRun.VB.AVN removal instruction

The Win32/AutoRun.VB.AVN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/AutoRun.VB.AVN virus can do?

Behavioural detection: Executable code extraction – unpacking
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Behavioural detection: Injection (inter-process)
Attempts to disable Windows Auto Updates
Anomalous binary characteristics
Attempts to modify Explorer settings to prevent hidden files from being displayed
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/AutoRun.VB.AVN?


File Info:
name: BB14F2330A6B81731526.mlwpath: /opt/CAPEv2/storage/binaries/880b81382edadec38295c870f50e48c5772b8d32f145ee61ea64952fb259e7becrc32: B2FFA31Bmd5: bb14f2330a6b8173152684e327674a5bsha1: 263562274d3f532e1a16b5a4aca220a43d5c1791sha256: 880b81382edadec38295c870f50e48c5772b8d32f145ee61ea64952fb259e7besha512: 04385dc2fd156babc26d12ad4a8bce082f5eb988bae6bf3b27f74419712fc8d99fdb993eda5b1701faf41efeb913c54861f509d0dfc81b6c82a252c0c985478cssdeep: 6144:+KO33dwqsNy5ibpNjl4EqxF6snji81RUinKICCF:rOHdQxlUtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10534D7A77B719888F418157058F3D3F23796EC4D494B520B2B243E2A3FBBE652D24A53sha3_384: 03595a74401330d5da1d0fd8075973b9b6775c175839ddf941881a2694748303a01f27c492b07ceb2f06169ffc0ef599ep_bytes: 688c124000e8eeffffff000000000000timestamp: 2012-05-04 05:48:36
Version Info:
Translation: 0x0409 0x04b0ProductName: jpplyryFileVersion: 7.08.0002ProductVersion: 7.08.0002InternalName: lfjadwyqolOriginalFilename: lfjadwyqol.exe

Win32/AutoRun.VB.AVN also known as:

Lionic	Trojan.Win32.Vobfus.lL56
tehtris	Generic.Malware
DrWeb	Trojan.MulDrop3.48626
MicroWorld-eScan	Trojan.GenericKDZ.98339
FireEye	Generic.mg.bb14f2330a6b8173
CAT-QuickHeal	Trojan.Beebone.D
ALYac	Trojan.GenericKDZ.98339
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	EmailWorm ( 0054d10f1 )
Alibaba	Worm:Win32/Vobfus.192ad950
K7GW	EmailWorm ( 0054d10f1 )
Cybereason	malicious.30a6b8
BitDefenderTheta	Gen:NN.ZevbaF.36196.om0@aWC@B8bi
Cyren	W32/Vobfus.O.gen!Eldorado
Symantec	W32.Changeup
Elastic	malicious (high confidence)
ESET-NOD32	Win32/AutoRun.VB.AVN
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Vobfus.sln
BitDefender	Trojan.GenericKDZ.98339
NANO-Antivirus	Trojan.Win32.Vobfus.cqkxvu
ViRobot	Trojan.Win32.A.VB.233472.O
Tencent	Worm.Win32.Vobfus.n
Sophos	W32/Vobfus-AN
F-Secure	Worm.WORM/Vobfus.ew.jh
Baidu	Win32.Worm.Autorun.af
VIPRE	Trojan.GenericKDZ.98339
TrendMicro	WORM_VOBFUS.SM00
McAfee-GW-Edition	BehavesLike.Win32.VBObfus.dt
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKDZ.98339 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Vbobf.b
Avira	WORM/Vobfus.ew.jh
Antiy-AVL	Worm/Win32.WBNA.gen
Xcitium	TrojWare.Win32.VB.AVA@4paxk7
Arcabit	Trojan.Generic.D18023
SUPERAntiSpyware	Trojan.Agent/Gen-Vban
ZoneAlarm	Trojan.Win32.Vobfus.sln
GData	Trojan.GenericKDZ.98339
TACHYON	Trojan/W32.Vobfus.233472
AhnLab-V3	Trojan/Win32.VB.R24629
McAfee	VBObfus.dv
MAX	malware (ai score=89)
VBA32	SScope.Malware-Cryptor.VBCR.3042
Malwarebytes	Generic.Worm.AutoRun.DDS
Panda	W32/Vobfus.GEW.worm
TrendMicro-HouseCall	WORM_VOBFUS.SM00
Rising	Trojan.FakeIcon!1.64A2 (CLASSIC)
Yandex	Trojan.GenAsa!vv6zMG0Mexk
Ikarus	Worm.Vobfus
Fortinet	W32/Jorik.EGLG!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)