Win32/Spy.VB.NUT removal guide

The Win32/Spy.VB.NUT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.VB.NUT virus can do?

Executable code extraction
Sniffs keystrokes
Anomalous binary characteristics

How to determine Win32/Spy.VB.NUT?


File Info:
crc32: DAAA59EA
md5: 020b2eee9acc9415678ad63370f9c584
name: 020B2EEE9ACC9415678AD63370F9C584.mlw
sha1: 18981797cc2d2bad5be24d09ec1e42c5f34fd009
sha256: 5333bb8a3f078cba15b1ec32f589077981ec2b370f7962c967adc98f7eac1943
sha512: 6ed4cd856d0c878472400108348024eca51cc4272ed7bd3b21b46a084e74e2d88788785e5b8fb476bfe1a577bf147486af86ee53e41d9317ce16dd9206ade9d4
ssdeep: 192:YfoL0s9JNHJnFskQm3r+NP/I1sbaDmPWxE:Q0/HwkXuXI1eaDmPWxE
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: Microsoft Corp.
InternalName: svhcost
FileVersion: 2.00.0001
CompanyName: Microsoft Corporation
LegalTrademarks: Microsoft Corp.
ProductName: svchost.exe
ProductVersion: 2.00.0001
FileDescription: svchost.exe
OriginalFilename: svhcost.exe

Win32/Spy.VB.NUT also known as:

DrWeb	Trojan.Bankfraud.1043
Cynet	Malicious (score: 99)
ALYac	Gen:Trojan.Heur.bm0@XudZxbli
Cylance	Unsafe
Alibaba	TrojanSpy:Win32/Generic.816dc412
Cybereason	malicious.e9acc9
Cyren	W32/Backdoor.QQCS-2202
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Spy.VB.NUT
APEX	Malicious
Avast	Win32:ClipBanker-B [Trj]
BitDefender	Gen:Trojan.Heur.bm0@XudZxbli
NANO-Antivirus	Trojan.Win32.Bankfraud.ctjpob
MicroWorld-eScan	Gen:Trojan.Heur.bm0@XudZxbli
Tencent	Win32.Trojan.Keylog.Ud
Ad-Aware	Gen:Trojan.Heur.bm0@XudZxbli
Sophos	Mal/Generic-S
Comodo	Malware@#27synx2audi3r
BitDefenderTheta	AI:Packer.C3EA54D81C
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Trojan.mz
FireEye	Gen:Trojan.Heur.bm0@XudZxbli
Emsisoft	Gen:Trojan.Heur.bm0@XudZxbli (B)
Avira	TR/Crypt.FKM.Gen
eGambit	Unsafe.AI_Score_82%
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Win32.VB.4!c
GData	Gen:Trojan.Heur.bm0@XudZxbli
AhnLab-V3	Trojan/Win32.Msposer.C255392
McAfee	Artemis!020B2EEE9ACC
MAX	malware (ai score=81)
VBA32	TScope.Trojan.VB
TrendMicro-HouseCall	TROJ_GEN.R002C0GDB21
Rising	Trojan.Keylog!1.9946 (CLOUD)
Yandex	TrojanSpy.VB!hyQ3SukHkj0
Ikarus	Trojan.Win32.Spy
Fortinet	W32/VB.NUT!tr.spy
AVG	Win32:ClipBanker-B [Trj]
Qihoo-360	Win32/TrojanSpy.ClipBanker.HwMAEpsA

How to remove Win32/Spy.VB.NUT?

Win32/Spy.VB.NUT removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X