Win64/Packed.VMProtect.NM removal guide

The Win64/Packed.VMProtect.NM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64/Packed.VMProtect.NM virus can do?

The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Win64/Packed.VMProtect.NM?


File Info:
crc32: F6986BDC
md5: d8cf58004f66339acefc2b6f1c6ecdc8
name: D8CF58004F66339ACEFC2B6F1C6ECDC8.mlw
sha1: 6171f8673ad48dc0ca5b62bd49d8202d9beb3933
sha256: 8ff340bd6201a5fe37594d4c5257729d42a9030a22566999b123a7f2c783590b
sha512: b71adc69a5bc5b68cf83839d58125fabc430d3bd02e63865463ecfe921fc37c98e5ca643385aff07003b2967f12c41d38dbe160d3bb17d6dd9b09490866a15e9
ssdeep: 196608:FLvl5PCjXPPMGHMZnliZSBqmBPkShDyE8:j5Pks6MZnmSUm2Shk
type: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows

Version Info:
LegalCopyright: Copyright (c) 2013 Flexera Software LLC. All Rights Reserved.
FileVersion: 3,1,0,0
CompanyName: AutoVPNConnect
ProductName: mvhBytes
ProductVersion: 3,1,0,0
FileDescription: AutoVPNConnect Launcher Unicode
FileTitle: AutoVPNConnect
LegalTrademark: 
Translation: 0x0409 0x04b0

Win64/Packed.VMProtect.NM also known as:

Lionic	Trojan.Multi.Generic.4!c
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
BitDefender	Trojan.GenericKD.37955315
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win64/Packed.VMProtect.NM
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win64.Inject.iq
MicroWorld-eScan	Trojan.GenericKD.37955315
Ad-Aware	Trojan.GenericKD.37955315
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.UMal.hisce@0
McAfee-GW-Edition	BehavesLike.Win64.Injector.vc
FireEye	Generic.mg.d8cf58004f66339a
Emsisoft	Trojan.Packed (A)
Webroot	W32.Trojan.GenKD
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Trojan.Heur!.02296123
Arcabit	Trojan.Generic.D24326F3
GData	Win32.Application.Coinminer.GGRFTM
McAfee	Artemis!D8CF58004F66
MAX	malware (ai score=83)
Malwarebytes	Trojan.Agent
Ikarus	Trojan.Win64.Vmprotect
Fortinet	Riskware/Application
Paloalto	generic.ml

How to remove Win64/Packed.VMProtect.NM?

Win64/Packed.VMProtect.NM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X