Win32:VB-DHR [Wrm] removal guide

The Win32:VB-DHR [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:VB-DHR [Wrm] virus can do?

The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid

How to determine Win32:VB-DHR [Wrm]?


File Info:
name: D3DCB4DF55FFB0BC97E4.mlw
path: /opt/CAPEv2/storage/binaries/345350c748508ee3ddec6cc755836f8408f65a4dd2439d0c9b7f8ce87f0d302a
crc32: CE3F7F31
md5: d3dcb4df55ffb0bc97e46d129f8560a8
sha1: 7a329a27e0c02251644e296097298cf8fc21f057
sha256: 345350c748508ee3ddec6cc755836f8408f65a4dd2439d0c9b7f8ce87f0d302a
sha512: bd3b051ff998bce63799d8fc360655c393908ca49aa5dc42ab4e155467fdeaaf8ece264ffa147f650fab94c5f0123f28a5f9190d5786ec5c75118a9e0430103e
ssdeep: 3072:4BeH4sa2QD7MRWrUBluGjvocpd6iPminKSdEjBDJRWci+k:4BY+32WWluqvHpVmXWEjFJRWci+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C2D3D417FB517129F263847A3838922AA4293D351A41AC1BF3826F5A34716D3F9F172F
sha3_384: 7d41f7303afa8617022868f9f1c95144aba5d3443f08cc860b086dd3c3257870ffa441459b2d2b0b049a4052a6a40b15
ep_bytes: e9560b00000058055a0b00008b3003f0
timestamp: 2007-01-12 10:04:58

Version Info:
Translation: 0x0409 0x04b0
Comments: Microsoft Corporation
CompanyName: File Folder
ProductName:  
FileVersion: 1.00
ProductVersion: 1.00
InternalName: FILE FOLDER
OriginalFilename: FILE FOLDER.exe

Win32:VB-DHR [Wrm] also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.im0@r9yEwGjib
FireEye	Generic.mg.d3dcb4df55ffb0bc
McAfee	GenericRXAA-FA!D3DCB4DF55FF
Cylance	Unsafe
Zillya	Worm.NoonLight.Win32.241
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan ( 005998f21 )
K7GW	Trojan ( 005998f21 )
Cybereason	malicious.f55ffb
Baidu	Win32.Worm.VB.a
Cyren	W32/Backdoor.J.gen!Eldorado
Symantec	W32.Lunalight@mm
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/NoonLight.Z
APEX	Malicious
ClamAV	Win.Worm.Moonlight-9775620-0
Kaspersky	UDS:Trojan.Win32.Hesv.fzmy
BitDefender	Gen:Trojan.Heur.im0@r9yEwGjib
Avast	Win32:VB-DHR [Wrm]
Tencent	HF:Worm.Win32.Vb.wa
Ad-Aware	Gen:Trojan.Heur.im0@r9yEwGjib
Comodo	TrojWare.Win32.Trojan.VB.~C@mmmg2
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoader6.64360
VIPRE	Gen:Trojan.Heur.im0@r9yEwGjib
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Patched
GData	Gen:Trojan.Heur.im0@r9yEwGjib
Jiangmin	Trojan/Refroso.afgk
Webroot	Trojan.Dropper
Avira	TR/Dropper.Gen
MAX	malware (ai score=86)
Arcabit	Trojan.Heur.ED40F6
ZoneAlarm	UDS:Trojan.Win32.Hesv.fzmy
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Google	Detected
AhnLab-V3	Worm/Win.VB.R526135
Acronis	suspicious
BitDefenderTheta	AI:Packer.40EB29D51D
ALYac	Gen:Trojan.Heur.im0@r9yEwGjib
Rising	Worm.VBInjectEx!1.99E6 (CLASSIC)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/NoonLight.Z!worm
AVG	Win32:VB-DHR [Wrm]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32:VB-DHR [Wrm]?

Win32:VB-DHR [Wrm] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X