How to remove “Win32:VB-ABYT [Trj]”?

The Win32:VB-ABYT [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:VB-ABYT [Trj] virus can do?

• Sample contains Overlay data
• Unconventionial language used in binary resources: Spanish (Modern)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32:VB-ABYT [Trj]?

File Info:
name: 63A498B243D2DFCFB236.mlw
path: /opt/CAPEv2/storage/binaries/c3e3283c217cc1b3f28e3d68fd7e8abc0f51f788ba1e85690e1edbfd17baea31
crc32: B03A6D25
md5: 63a498b243d2dfcfb236dcd951fc4a90
sha1: 3399a786f27afd74cff158464f4f835ef1374533
sha256: c3e3283c217cc1b3f28e3d68fd7e8abc0f51f788ba1e85690e1edbfd17baea31
sha512: 578a098c1a8ad7f488d854289c80a172caae1aa63d6f89774d467a3cb02f6f75b70984a9e9cdcb76eb08e400c0913362c33608748efe905949921286c78d1867
ssdeep: 12288:3bk2y3fRx3m73Cbfccr2J6iKwnU1aurh9cpCpC8bCWI+cCs/Q4bBcQSvSMiyYE:LkhfR5y3Sccr2J6gn039cpC7xITKvFYE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19CF42378358AFC46F0691D329E04A9D9313BFEF92904891F25A9B7DF57FB243B604121
sha3_384: e3d710fcbdf7b61af8cc39541986935fd057ef8ab86360ac90869ff870dd3ad497a48a668bfafa09b50a6f7b82345eaa
ep_bytes: 9c60e80200000033c08bc483c004938b
timestamp: 2010-12-01 20:33:25

Version Info:
Translation: 0x0c0a 0x04b0
ProductName: Proyecto1
FileVersion: 1.05.0009
ProductVersion: 1.05.0009
InternalName: stubcryp
OriginalFilename: stubcryp.exe
OLESelfRegister: 

Win32:VB-ABYT [Trj] also known as:

How to remove Win32:VB-ABYT [Trj]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.