Win32:AutoRun-BRL [Wrm] removal tips

The Win32:AutoRun-BRL [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:AutoRun-BRL [Wrm] virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32:AutoRun-BRL [Wrm]?


File Info:
name: 0DA585F8FBEAFCA6879B.mlw
path: /opt/CAPEv2/storage/binaries/5c4ea63578adc789d1c4044122513c3333fdcf58ce77503fcc843c2c39bd5dbb
crc32: E1C89E85
md5: 0da585f8fbeafca6879b2c160d2df45f
sha1: b782d863eccf10844654d6305e21fdeb4cf7c120
sha256: 5c4ea63578adc789d1c4044122513c3333fdcf58ce77503fcc843c2c39bd5dbb
sha512: 5321432ce7f58b560e48677cce5d6c06c0ff6f9ec3481d1115ab088d01fdd50a2e5e2032434e626318e4a296b065c2c2619be7bf5f739e553610ec2c2d36a776
ssdeep: 24576:kT3XbtcrGMJLpxoD4lCy+OPCy47jIT1OC4QhbeeEAiWcC0crTq:kSGOPCy47kv4ydi0vq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17E15D023F39194B2D027293D8C5B53A8999A7EA13D296C463BEC3D0D5F393C13D26297
sha3_384: 9e31fb3b6331f070c9c9e90aeb5c94052e0aa5ee649fca13ce8cb8bc6854e2ffa2e73f95f16a372e787b65d9a60df3c0
ep_bytes: 778bcc83c431f8b4f54c05ec9463fbfe
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Win32:AutoRun-BRL [Wrm] also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Smokeloader.ch
McAfee	Corrupt-PE
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.3eccf1
Baidu	Win32.Worm.Delf.f
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Worm.Ulise-9808222-0
Avast	Win32:AutoRun-BRL [Wrm]
F-Secure	Trojan.TR/Patched.Ren.Gen
Sophos	Mal/Generic-S
Ikarus	Worm.Win32.Delf
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Worm/Win32.Autorun
Kingsoft	malware.kb.a.999
Microsoft	Trojan:Win32/Wacatac.B!ml
Varist	W32/Autorun.BO.gen!Eldorado
Cylance	unsafe
Zoner	Trojan.Win32.68836
Rising	Worm.IncaseFormat!1.D153 (CLASSIC)
SentinelOne	Static AI – Malicious PE
AVG	Win32:AutoRun-BRL [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32:AutoRun-BRL [Wrm]?

Win32:AutoRun-BRL [Wrm] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X