How to remove “Win32/VB.THO”?

The Win32/VB.THO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/VB.THO virus can do?

Behavioural detection: Executable code extraction – unpacking
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/VB.THO?


File Info:
name: 7FA6854079F2DECB5786.mlw
path: /opt/CAPEv2/storage/binaries/61c9daee695671739c049d08a997461b3bc053d37f74940736ff83f1ef9c45d0
crc32: ACC70994
md5: 7fa6854079f2decb5786d70333cf9da3
sha1: 79da78dbd1a35fb200796e5ec273e747766d3ffb
sha256: 61c9daee695671739c049d08a997461b3bc053d37f74940736ff83f1ef9c45d0
sha512: 4ebb5e3251ed3f0abc8321d40e4b014731f42c1235acb83cce3c5ab813875225ef3ee2f9db192121a1ea6408e83c9074db8c83983c0cd4a30d0690a6be7a5a99
ssdeep: 384:3njL6fmVlcrnnMem5MldWtRWcgDTlBqV1UYTtHdDk0L6fmVlcrnnMem5M:3nFcrnnMP5ftRWcwBBq/15qYcrnnMP5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D53C483279041A1DA2A5B3569B796BF49AF7D343E32F4092244FE773F33DA24804E56
sha3_384: c1ae10983064ccd561a300c7b78034b4a6cb61e7160be765842bfb896bccde52630fbaee934966d54db759d8f470b06b
ep_bytes: 6844554000e8eeffffff000000000000
timestamp: 2023-08-06 18:04:38

Version Info:
Translation: 0x0409 0x04b0
CompanyName: noOrg
ProductName: ETC
FileVersion: 1.00
ProductVersion: 1.00
InternalName: setup
OriginalFilename: setup.exe

Win32/VB.THO also known as:

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 99)
Cylance	unsafe
CrowdStrike	win/malicious_confidence_90% (D)
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/VB.THO
APEX	Malicious
F-Secure	Trojan.TR/Crypt.XPACK.Gen
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.7fa6854079f2decb
Avira	TR/Crypt.XPACK.Gen
Rising	Trojan.VB!8.B20 (TFE:5:fFo2mLeYmDH)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Cybereason	malicious.bd1a35
DeepInstinct	MALICIOUS

How to remove Win32/VB.THO?

Win32/VB.THO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X