Win32:AutoIt-BYV [Trj] removal guide

The Win32:AutoIt-BYV [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:AutoIt-BYV [Trj] virus can do?

Unconventionial language used in binary resources: Arabic
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Win32:AutoIt-BYV [Trj]?


File Info:
name: 83C1EF5A2D7EA8B1AF52.mlw
path: /opt/CAPEv2/storage/binaries/34ce8f19045b5a70378c6fcede8d7d3f50e0f2b7ac2e2c64d8af5a7e3ba42d15
crc32: 869C8414
md5: 83c1ef5a2d7ea8b1af5266a1f66a910f
sha1: 8daca0fa6d4fa1976e314051241763a724e49fd8
sha256: 34ce8f19045b5a70378c6fcede8d7d3f50e0f2b7ac2e2c64d8af5a7e3ba42d15
sha512: 1bd84fda276d7d0adbd834a47f9b4eb99d4a80246ef8d404ea28b1a1e834d1925c7fa58db4d8c283cf6a561d51374b54c0272c331af41779d0a0401b4abb46b7
ssdeep: 3072:9ORlK/YAXPQGRc34RLF3/L6SKAO7p7TP4Wr0rjrHrJroEv:9qK/RPQGRc3+vLrKAqlD7r0rjrHrJr
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DAF3292AF715048ADA5DA17136878FF354B378489B4F11C933A873AABC39E12453DB1B
sha3_384: 1db8a987c88f56745947ad90d0f74411bad697e298062f6f51129b801bd27917e7ca9dead1dfcc2b39607cbadbb0f2f3
ep_bytes: 60be00b044008dbe0060fbff5783cdff
timestamp: 2011-06-16 19:47:22

Version Info:
Translation: 0x0409 0x04b0
CompanyName:  
ProductName:  
FileVersion: 1.00
ProductVersion: 1.00
InternalName: stub
OriginalFilename: stub.bin

Win32:AutoIt-BYV [Trj] also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Trojan.Heur.km0@!Z8Im9fO
FireEye	Generic.mg.83c1ef5a2d7ea8b1
ALYac	Gen:Trojan.Heur.km0@!Z8Im9fO
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.a2d7ea
Baidu	Win32.Worm.Agent.y
Elastic	malicious (moderate confidence)
APEX	Malicious
ClamAV	Win.Packed.Shakblades-9811684-0
BitDefender	Gen:Trojan.Heur.km0@!Z8Im9fO
Avast	Win32:AutoIt-BYV [Trj]
Ad-Aware	Gen:Trojan.Heur.km0@!Z8Im9fO
Comodo	Packed.Win32.MUPX.Gen@24tbus
McAfee-GW-Edition	BehavesLike.Win32.BadFile.cm
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
Ikarus	P2P-Worm.Win32.BlackControl
GData	Gen:Trojan.Heur.km0@!Z8Im9fO
Avira	TR/Crypt.ULPM.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Worm/Win32.Shakblades.R23899
McAfee	Artemis!83C1EF5A2D7E
MAX	malware (ai score=88)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/ULPM.16C0!tr
BitDefenderTheta	AI:Packer.A76983D21C
AVG	Win32:AutoIt-BYV [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32:AutoIt-BYV [Trj]?

Win32:AutoIt-BYV [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X