Worm

Worm.SlenfBot.Gen removal guide

Malware Removal

The Worm.SlenfBot.Gen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Worm.SlenfBot.Gen virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Created a process from a suspicious location

How to determine Worm.SlenfBot.Gen?



File Info:

name: 7396DB62EE957E3E6187.mlw
path: /opt/CAPEv2/storage/binaries/879d20ac209272032e312ca7ba96aa2e68fde9f778f1e40f461c55b9f1cf38ab
crc32: C4418096
md5: 7396db62ee957e3e6187809e57797902
sha1: 307bef75f8802162939b2b551984fda1ab33286e
sha256: 879d20ac209272032e312ca7ba96aa2e68fde9f778f1e40f461c55b9f1cf38ab
sha512: 91e51938cbb84a5106330a6a1e3a0af8096b57409e397f4df84346c5efbda6bc5ae75ae89430a1ce692254eba156bd9f3e04c4f0fc07ff05fb30f7f69a7b1a19
ssdeep: 196608:rnSUvUO9KG9N64MyY+H8rBmmRNmCdbblbza:rntvUO9VXfHWrmCdbbpG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18276334BBAC2F03DF144723E9D20699E9B7C4E5D32A4517D2ED21F4D0642FAA0EA94F4
sha3_384: 8b343b8f9685990c74280c5bcd5cac66c8803cc08ee926ff4e1bb6728ed30cd990541fd12e9da959652eb7a6bae1e826
ep_bytes: 60be00504a008dbe00c0f5ff57eb0b90
timestamp: 2005-05-17 14:15:44


Version Info:

CompanyName: Kawetyl Osclmswfb
FileDescription: Kawetyl Ugntspq Rywhbps
FileVersion: 52,71,79,88
InternalName: Kawetyl
LegalCopyright: Copyright © Kawetyl Osclmswfb 2004-2007
OriginalFilename: Kawetyl.exe
ProductName: Kawetyl Ugntspq Rywhbps
ProductVersion: 95,17,57,80
Translation: 0x0409 0x04e4

Worm.SlenfBot.Gen also known as:

LionicWorm.Win32.Kolab.p!c
Elasticmalicious (high confidence)
DrWebTrojan.Siggen2.31997
MicroWorld-eScanGen:Heur.VIZ.!e!.1
FireEyeGeneric.mg.7396db62ee957e3e
CAT-QuickHealWorm.SlenfBot.Gen
ALYacGen:Heur.VIZ.!e!.1
CylanceUnsafe
VIPRETrojan.Win32.Kryptik.lbu (v)
SangforBackdoor.Win32.Generic.571230
AlibabaVirTool:Win32/Obfuscator.5f84cba4
Cybereasonmalicious.2ee957
BitDefenderThetaGen:NN.ZexaF.34212.@pNfaiX!zMfc
CyrenW32/Sefnit.G.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/Kryptik.LDY
TrendMicro-HouseCallWORM_KOLAB.SMB
ClamAVWin.Trojan.Kolab-1583
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.VIZ.!e!.1
NANO-AntivirusTrojan.Win32.Kolab.btuwkw
SUPERAntiSpywareTrojan.Agent/Gen-Faldesc[Cont]
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.10b9f2bb
Ad-AwareGen:Heur.VIZ.!e!.1
SophosMal/Generic-R + Mal/Zbot-EZ
ComodoTrojWare.Win32.TrojanSpy.Zbot.G@2tckk5
ZillyaWorm.Kolab.Win32.5256
TrendMicroWORM_KOLAB.SMB
McAfee-GW-EditionBehavesLike.Win32.Dropper.vc
SentinelOneStatic AI – Malicious PE
EmsisoftGen:Heur.VIZ.!e!.1 (B)
IkarusTrojan.Win32.Sefnit
GDataGen:Heur.VIZ.!e!.1
JiangminWorm/Kolab.gdq
WebrootW32.Trojan.Gen
AviraTR/Dropper.Gen
Antiy-AVLTrojan/Generic.ASMalwS.184C105
ViRobotWorm.Win32.A.Net-Kolab.2427753[UPX]
MicrosoftTrojan:Win32/Sefnit.G
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win32.FraudPack.R3415
McAfeeSefnit.ad
VBA32Trojan.Zeus.EA.0999
RisingTrojan.Win32.fedoN.hi (CLOUD)
YandexTrojan.GenAsa!rTvAwvnOGnE
MAXmalware (ai score=100)
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/Kryptik.NAS!tr
AVGWin32:Malware-gen
PandaBck/Qbot.AO
CrowdStrikewin/malicious_confidence_60% (W)

How to remove Worm.SlenfBot.Gen?

Worm.SlenfBot.Gen removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment