Malware

Should I remove “Win32:VB-JHS [Wrm]”?

Malware Removal

The Win32:VB-JHS [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32:VB-JHS [Wrm] virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality

How to determine Win32:VB-JHS [Wrm]?



File Info:

name: CB00BA77C041DC42AA49.mlw
path: /opt/CAPEv2/storage/binaries/370d59ff92808f0ab2e12c0f0880803316d861b1f9e51f5ba2aac0ca60c8e87f
crc32: 11A9323E
md5: cb00ba77c041dc42aa494488f3791b0e
sha1: 3bd1d7521edddb035c9aab92ee318300bc813206
sha256: 370d59ff92808f0ab2e12c0f0880803316d861b1f9e51f5ba2aac0ca60c8e87f
sha512: 28688eda9effd6567f282be999691c1854e8584119d7553a626ac4886e8d59939f80641b6a048943b444a499bdadba742c4efe8d787c931c2e4f6326fd251d8a
ssdeep: 6144:yF/WqWcLcls2X/MJLk+9cYWy4DswMtV+55oWmE6TusW:y8QcfqLP2swnfoWmE1sW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16984E51173F91A29F6F36B746EF5A199587AFCB26D31C41F6260064E0871E81EE60B33
sha3_384: 53ba8b78974d4d254dc62401720737b58e376a431eefe0229ee16479dfa6fbcb049b36d9ef525b1172dff919098cd8de
ep_bytes: 68488f4000e8f0ffffff000000000000
timestamp: 2008-06-08 14:36:24


Version Info:

Translation: 0x0804 0x04b0
CompanyName: 2146
ProductName:  
FileVersion: 1.00
ProductVersion: 1.00
InternalName: avp
OriginalFilename: avp.exe

Win32:VB-JHS [Wrm] also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebWin32.HLLW.Autoruner.2173
MicroWorld-eScanWin32.Worm.SoulClose.E
FireEyeGeneric.mg.cb00ba77c041dc42
McAfeeArtemis!CB00BA77C041
ZillyaWorm.VB.Win32.481
K7AntiVirusP2PWorm ( 004e419d1 )
K7GWP2PWorm ( 004e419d1 )
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderThetaAI:Packer.254A2CEF15
CyrenW32/Worm.Soul.gen!Eldorado
SymantecW32.Fujacks.C
ESET-NOD32a variant of Win32/AutoRun.VB.HG
ClamAVWin.Worm.Soulclose-7085422-0
KasperskyWorm.Win32.VB.rc
BitDefenderWin32.Worm.SoulClose.E
NANO-AntivirusTrojan.Win32.VB.ooto
SUPERAntiSpywareWorm.SoulClose/Variant
AvastWin32:VB-JHS [Wrm]
Ad-AwareWin32.Worm.SoulClose.E
EmsisoftWin32.Worm.SoulClose.E (B)
ComodoVirus.Win32.VB.~A@ziv7
BaiduWin32.Worm.VB.bc
VIPRETrojan.Win32.Generic.pak!cobra
McAfee-GW-EditionBehavesLike.Win32.PWSZbot.fm
SophosML/PE-A + W32/OYSoul-Gen
IkarusVirus.Worm.Win32.VB
GDataWin32.Worm.SoulClose.E
JiangminPacked.Krap.gvwo
AviraTR/VB.dek.2
MAXmalware (ai score=88)
Antiy-AVLTrojan/Generic.ASMalwS.128E01C
MicrosoftWorm:Win32/Soulclose.B
CynetMalicious (score: 100)
AhnLab-V3Worm/Win32.VB.R287861
ALYacWin32.Worm.SoulClose.E
CylanceUnsafe
APEXMalicious
TencentMalware.Win32.Gencirc.114b9994
YandexWorm.VB!R9/ixfALmfo
SentinelOneStatic AI – Malicious PE
FortinetW32/VB.MJU!tr
AVGWin32:VB-JHS [Wrm]
Cybereasonmalicious.7c041d
PandaTrj/Genetic.gen

How to remove Win32:VB-JHS [Wrm]?

Win32:VB-JHS [Wrm] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment