About “Win32:VB-YIT [Trj]” infection

The Win32:VB-YIT [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:VB-YIT [Trj] virus can do?

At least one process apparently crashed during execution
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32:VB-YIT [Trj]?


File Info:
name: 3C8E56EE7AB5C759EBC2.mlw
path: /opt/CAPEv2/storage/binaries/ec291ddcaeb565305e04c2fa337d5506781e89857812885efa935fbd30937042
crc32: 7300E5E4
md5: 3c8e56ee7ab5c759ebc2fed2984786e5
sha1: 6d481b785fbcefe1839f45218ba5d67ffdb8297a
sha256: ec291ddcaeb565305e04c2fa337d5506781e89857812885efa935fbd30937042
sha512: 44b0607d26d6eeab268aeff6a571caba26b617056118a03b7403cde7e5407e427a5ae9b7c5ce7902849cb7bff3ad49c16215990afc6a565733e482a1e34b8468
ssdeep: 3072:hnQBn5VirgFv/R74+wxXcIFkL4PT4ITvg2Z3Nz2a:hQBzuav/R7vSc+T
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T157243102A581E5B8E512C3B82A16E3B0D1316F75DBA3F572B6C3BF2D3676C572310266
sha3_384: 838166e419a6e1e1e253b69fd772833d2341f1fa9a14091a2ace7e87f7d98ac5c16ec2849cdd36f3b81629106cc85874
ep_bytes: 6808334000e8eeffffff000000000000
timestamp: 1995-11-19 02:15:48

Version Info:
0: [No Data]

Win32:VB-YIT [Trj] also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.84359
FireEye	Generic.mg.3c8e56ee7ab5c759
McAfee	GenericRXKC-QZ!3C8E56EE7AB5
Cylance	Unsafe
Sangfor	[MICROSOFT VISUAL BASIC 5.0]
K7AntiVirus	NetWorm ( 700000151 )
K7GW	NetWorm ( 700000151 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Worm.Pronny.d
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Malware.Vobfus-9654490-0
Kaspersky	Worm.Win32.VBKrypt.be
BitDefender	Trojan.GenericKDZ.84359
Avast	Win32:VB-YIT [Trj]
Tencent	Malware.Win32.Gencirc.10b8f0c5
Ad-Aware	Trojan.GenericKDZ.84359
Sophos	ML/PE-A
Comodo	Worm.Win32.AutoRun.AMH@4owee9
DrWeb	Trojan.VbCrypt.60
Emsisoft	Trojan.GenericKDZ.84359 (B)
Ikarus	Trojan.Spy.Agent
Avira	TR/Spy.Agent.155646
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKDZ.84359
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.RL_VBKrypt.R325278
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZevbaF.34638.mqZ@aStaORn
ALYac	Trojan.GenericKDZ.84359
Rising	Trojan.Fuerboos!8.EFC8 (C64:YzY0OgH9ZZVODLjucg)
Yandex	Trojan.VBGent.Gen.714
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.F
AVG	Win32:VB-YIT [Trj]
Cybereason	malicious.e7ab5c

How to remove Win32:VB-YIT [Trj]?

Win32:VB-YIT [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X