What is “Win32:VB-NSF [Wrm]”?

The Win32:VB-NSF [Wrm] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:VB-NSF [Wrm] virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32:VB-NSF [Wrm]?

File Info:
name: 31F768A29184A6F8591F.mlw
path: /opt/CAPEv2/storage/binaries/6930b70cb13681728ce43e344bbbed0ce6f260e2cd04f675a755fa37be8427ad
crc32: 06EBDABF
md5: 31f768a29184a6f8591f981325c1d648
sha1: 8b8d4e3f7d82b49bb4d7687393c2b569f379be39
sha256: 6930b70cb13681728ce43e344bbbed0ce6f260e2cd04f675a755fa37be8427ad
sha512: bd670cc93caa049ddc8229dca2377ddabb0c7262ae3b0b97d6a6ebcaf3cf58c12304c242dcd8d361b97d7ffb1cc6c7bbfd7ded382dc86adc3722393047cebd05
ssdeep: 768:o4Ha5MdAarqVD1J1twDd/v/jdISproC6RHwibw5/Fzp7x:oFtYqVD/HwDR3jRoC6RHOp7x
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1353371AF7AC75646E90C2339B1AFCAC46213F8D93E071243B05D277EB862D615E17227
sha3_384: 38e1c93756fa778bc2cba186dd0ec625884ae975ab9ca3dccd9f9e552f8a652d74ee926729060a2043a3ad902f4e8857
ep_bytes: 68d4124000e8eeffffff000000000000
timestamp: 2009-12-20 10:49:14

Version Info:
Translation: 0x0409 0x04b0
CompanyName: xrrAwOKh
ProductName: xrrAwOKh
FileVersion: 1.36
ProductVersion: 1.36
InternalName: xrrAwOKh
OriginalFilename: xrrAwOKh.exe

Win32:VB-NSF [Wrm] also known as:

How to remove Win32:VB-NSF [Wrm]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.