Win32:Virut-ANS removal guide

The Win32:Virut-ANS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Virut-ANS virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32:Virut-ANS?


File Info:
crc32: 3D01BF50
md5: bddbe0d6ff48e12635ea03a32496b585
name: BDDBE0D6FF48E12635EA03A32496B585.mlw
sha1: c21762e2c5e9c39927346e29fe2e76b4c0966889
sha256: 0fb74c24834b54a8bba444f5067d9ea8ae83b805cc63e14783cd7212f3b3c036
sha512: cce47351f0f13a8ae1226989efdfab48589ae9778d0caff86f2edaf8ab24697682bcdc08562fe337467ebcafe58ed9904220f55c9a4152c6e31029df2b19b4bf
ssdeep: 6144:IW7h5RHYUX6uL5u28DBaKO1BT/MADrHfAjU+iO7B0xy4Ajry10u6VPl:R7TR4UX6uL5uJDBa11BT/MADTA3hBv9p
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Volume Control Applet
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7601.17514
FileDescription: Volume Mixer
OriginalFilename: SndVol.exe
Translation: 0x0409 0x04b0

Win32:Virut-ANS also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.40144175
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.6ff48e
Cyren	W32/S-a39c9901!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Virut-ANS
BitDefender	Trojan.GenericKD.40144175
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
MicroWorld-eScan	Trojan.GenericKD.40144175
Ad-Aware	Trojan.GenericKD.40144175
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34690.uq0@auei26mi
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Virut.fh
FireEye	Generic.mg.bddbe0d6ff48e126
Emsisoft	Trojan.GenericKD.40144175 (B)
Avira	TR/Patched.Ren.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.40144175
TACHYON	Trojan/W32.PornoBlocker.340480
Acronis	suspicious
McAfee	Artemis!BDDBE0D6FF48
MAX	malware (ai score=88)
Malwarebytes	Sality.Virus.FileInfector.DDS
Rising	Trojan.Fuery!8.EAFB (RDMK:cmRtazoXVUpNKVSg23AAzL/n+5UJ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Generic.AC.1F97!tr
AVG	Win32:Virut-ANS
Paloalto	generic.ml

How to remove Win32:Virut-ANS?

Win32:Virut-ANS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X