About “Win32/PSW.VB.NFA” infection

The Win32/PSW.VB.NFA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/PSW.VB.NFA virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/PSW.VB.NFA?


File Info:
name: A08C51C6522A574662EF.mlw
path: /opt/CAPEv2/storage/binaries/c0b4541a67b962cd289594b498492f0c3fb641756fafadc167a1a7d189a97317
crc32: FFA9B0DE
md5: a08c51c6522a574662efa4a4007a9cbf
sha1: 23ff21fc1ec859efc6cb52c3d34c15e4358552e9
sha256: c0b4541a67b962cd289594b498492f0c3fb641756fafadc167a1a7d189a97317
sha512: 9986c130a3611bcb2ab202688fe9f1e9adb7f429c52a27c513515d5f1a518ec11cc2a703f6e2b61c9b828b8c6566ce2e511e3a49f7a2415a96f356b8eb20a226
ssdeep: 1536:Weox7d5E/qyC31lf5TY79I+twcF98jzRtCXDdP1asE2P46MjWUQnXPu:WeoxXEo31lf5kwGZNasE2Q6sQn/u
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D3A30822F6942025F1674AB13E78956A69297C360901EC1FF7819B4D38706D3FAF171F
sha3_384: 951be89dd81153cdee77685fed4292bf3a6ab8939cc386e786921410b9fd80ae971f0db1e0b43027d24d87799944b259
ep_bytes: 68e01f4000e8f0ffffff000000000000
timestamp: 2009-04-25 09:18:23

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Microsoft Corporation
FileDescription: Generic Host Process for Win32 Services
ProductName: Flash
FileVersion: 1.03.0229
ProductVersion: 1.03.0229
InternalName: wrk32
OriginalFilename: wrk32.exe

Win32/PSW.VB.NFA also known as:

Lionic	Trojan.Multi.Generic.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Jaiko.5145
FireEye	Generic.mg.a08c51c6522a5746
McAfee	Generic Malware.mt
Cylance	Unsafe
VIPRE	Gen:Variant.Jaiko.5145
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Password-Stealer ( 0005a7911 )
Alibaba	TrojanPSW:Win32/Reconyc.2ce18d7f
K7GW	Password-Stealer ( 0005a7911 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/PSW.VB.NFA
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.Reconyc.arf
BitDefender	Gen:Variant.Jaiko.5145
NANO-Antivirus	Trojan.Win32.Reconyc.cxnhaj
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Reconyc.Uylw
Ad-Aware	Gen:Variant.Jaiko.5145
Emsisoft	Gen:Variant.Jaiko.5145 (B)
Comodo	Malware@#2nqr21dyho7si
DrWeb	Trojan.DownLoader11.40529
Zillya	Trojan.Reconyc.Win32.3045
McAfee-GW-Edition	Generic Malware.mt
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Jaiko.5145
Jiangmin	Trojan/Reconyc.yr
Avira	TR/Spy.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.330C
Kingsoft	Win32.Troj.Reconyc.a.(kcloud)
Arcabit	Trojan.Jaiko.D1419
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Win-Trojan/MDA.140610.X1298
BitDefenderTheta	AI:Packer.D302BFDB1F
ALYac	Gen:Variant.Jaiko.5145
VBA32	Trojan.Reconyc
Malwarebytes	RiskWare.SpySoft
Rising	Malware.Undefined!8.C (TFE:5:ASioWwHVixD)
Yandex	Trojan.GenAsa!zwFh4ZVYK0s
Ikarus	BehavesLike
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Reconyc.ARF!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.6522a5
Panda	Generic Malware

How to remove Win32/PSW.VB.NFA?

Win32/PSW.VB.NFA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X