Malware

Win32:AutoRun-BSB [Wrm] removal tips

Malware Removal

The Win32:AutoRun-BSB [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:AutoRun-BSB [Wrm] virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the system manufacturer, likely for anti-virtualization
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

ns1.codeconline.biz
ns1.player1523.com

How to determine Win32:AutoRun-BSB [Wrm]?


File Info:

crc32: 06C2AF8B
md5: f87b690eca227b53ae891456548ae899
name: F87B690ECA227B53AE891456548AE899.mlw
sha1: c87a98b6a8199235b48a024f8e1354d6be2266ba
sha256: 7486501542b52fdeaefd20355f9d81b1a7806986f8f699dc96b1a500a831c4e2
sha512: 6c439e68804309b3dc1cf001cade7fb2f4ce0d60555782f49024a853b8a8c2fcf3c1b97141c25d17e9a19b6fd1d70ba38bed25c14dd9a7e568a029a6a4d63160
ssdeep: 1536:OIXuaUg/yumQb7bQ9mawbz05OBvDekMGoSX:x+aUg/yXm3
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
ProductVersion: 5.61
InternalName: xxmmT
FileVersion: 5.61
OriginalFilename: xxmmT.exe
ProductName: xxxxxxxxxxxxxxxx

Win32:AutoRun-BSB [Wrm] also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Midie.77333
FireEyeGeneric.mg.f87b690eca227b53
CAT-QuickHealWorm.VBNA.gen
McAfeeDownloader-CJX.gen.an
CylanceUnsafe
VIPRETrojan.Win32.Vobfus.a (v)
SangforMalware
K7AntiVirusTrojan-Downloader ( 001f4fd41 )
BitDefenderGen:Variant.Midie.77333
K7GWTrojan-Downloader ( 001f4fd41 )
Cybereasonmalicious.eca227
BaiduWin32.Worm.VB.al
CyrenW32/Vobfus.I.gen!Eldorado
SymantecW32.Changeup
TotalDefenseWin32/Vobfus.E!generic
APEXMalicious
AvastWin32:AutoRun-BSB [Wrm]
ClamAVWin.Trojan.VB-1318
KasperskyWorm.Win32.WBNA.ipa
NANO-AntivirusTrojan.Win32.VBKrypt.covkyp
ViRobotWorm.Win32.Agent.249856
RisingWorm.VobfusEx!1.99EB (CLASSIC)
Ad-AwareGen:Variant.Midie.77333
EmsisoftGen:Variant.Midie.77333 (B)
ComodoWorm.Win32.AutoRun.VA@247ynx
F-SecureTrojan.TR/Drop.Agent.chq
DrWebTrojan.Siggen2.5316
TrendMicroMal_VBNA
McAfee-GW-EditionBehavesLike.Win32.Downloader.dm
SophosML/PE-A + Mal/SillyFDC-D
IkarusWorm.Win32.Vobfus
MaxSecureTrojan.Malware.11973.susgen
AviraTR/Drop.Agent.chq
MAXmalware (ai score=83)
Antiy-AVLWorm/Win32.WBNA.gen
MicrosoftWorm:Win32/Vobfus.gen!D
ArcabitTrojan.Midie.D12E15
SUPERAntiSpywareTrojan.Agent/Gen-Frauder
ZoneAlarmWorm.Win32.WBNA.ipa
GDataGen:Variant.Midie.77333
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Chinky.R19217
Acronissuspicious
BitDefenderThetaAI:Packer.A747B03320
ALYacGen:Variant.Midie.77333
TACHYONWorm/W32.VB-WBNA.249856.B
VBA32SScope.Trojan.VBRA.75
MalwarebytesVobfus.Worm.Evasion.DDS
PandaTrj/Genetic.gen
ESET-NOD32Win32/AutoRun.VB.VE
TrendMicro-HouseCallMal_VBNA
TencentTrojan.Win32.VBKrypt.aab
YandexTrojan.GenAsa!h406ZqvqTIc
SentinelOneStatic AI – Malicious PE – Worm
eGambitUnsafe.AI_Score_99%
FortinetW32/AutoRun.VBB!tr
AVGWin32:AutoRun-BSB [Wrm]
CrowdStrikewin/malicious_confidence_100% (D)
Qihoo-360HEUR/QVM03.0.08BC.Malware.Gen

How to remove Win32:AutoRun-BSB [Wrm]?

Win32:AutoRun-BSB [Wrm] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment