Win32.Worm.Mabezat.Gen removal instruction

The Win32.Worm.Mabezat.Gen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32.Worm.Mabezat.Gen virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Creates an autorun.inf file
• Authenticode signature is invalid
• CAPE detected the embedded win api malware family
• Binary file triggered YARA rule
• Attempts to modify proxy settings
• Touches a file containing cookies, possibly for information gathering
• Harvests information related to installed mail clients
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent file extensions from being displayed
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32.Worm.Mabezat.Gen?

File Info:
name: E793063BC3A0CE4F8BF8.mlw
path: /opt/CAPEv2/storage/binaries/48134db7c767ac96f6aee70e666fe29921c5f9d9588aadd284921fa111ba541c
crc32: 33426476
md5: e793063bc3a0ce4f8bf832bde265bbfe
sha1: 13544ed190f06e7eb1a162f56ee3721c91ebd72b
sha256: 48134db7c767ac96f6aee70e666fe29921c5f9d9588aadd284921fa111ba541c
sha512: 52af9b46f5372e13cfd0bce984f3043d39e22a2d5441275b4c4c76026d6609fe8cf0d56092b527d28a09312ae56e9c79697e2b8298d5fe037a9b5c8b5720b1dc
ssdeep: 24576:E30zJ529+RipvL1SXk1QE1RGOTnIEQc4au9NgxnHNn3mey98A:EEq9+ApwXk1QE1RzsEQPaxHN3zg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F965F1C275E24472D0E3B2305E5ECB6A96273C2693E1653F639C6F0AB971280B61D773
sha3_384: 86a1cf9e842a9c85c3b437057137e1943122386a4805e911b8f78480c8967e283d1ec4ec844f5025b0f27d0a93188af3
ep_bytes: bba94881c693e920010000b75dc0bc68
timestamp: 2018-03-15 13:15:05

Version Info:
Comments: http://www.autoitscript.com/autoit3/
CompanyName: AutoIt Team
FileDescription: Aut2Exe
FileVersion: 3, 3, 14, 5
InternalName: Aut2Exe.exe
LegalCopyright: ©1999-2018 Jonathan Bennett & AutoIt Team
OriginalFilename: Aut2Exe.exe
ProductName: Aut2Exe
ProductVersion: 3, 3, 14, 5
Translation: 0x0809 0x04b0

Win32.Worm.Mabezat.Gen also known as:

How to remove Win32.Worm.Mabezat.Gen?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.