Worm.VB removal guide

The Worm.VB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.VB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Worm.VB?


File Info:
name: F96746DC51EF80A653FD.mlw
path: /opt/CAPEv2/storage/binaries/fdedf216304f3283adc03f4bf12baa5697ee522cf0b38435d3b0fadc8d74147b
crc32: 81EE57AA
md5: f96746dc51ef80a653fd867f56fb9815
sha1: 616e72affe23ff8fc852371e29dad76b12dbc9e5
sha256: fdedf216304f3283adc03f4bf12baa5697ee522cf0b38435d3b0fadc8d74147b
sha512: 80676ad10b1358f8d60f9238d5cc8d4544f46e13a06da6e721b516f3400570082998011dc158fbee20e773b73072a75f34e465ecb0f1813df7e25bd3bb0d6458
ssdeep: 24576:tmXVavwIT8P/oXSaGFmXVavwIT8P/oXSaG8alYjboGxZqwijaahIJpXMT9+Dc+lg:tHvbTrrGFHvbTrrGPlYvoGxUSJpXMu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T121D5060DFEA08C75E16245354466932E96757D109B238ECB63807E9EFFB2FC0A925732
sha3_384: fa91d6b867d6eb3c4b82283f1b537449a4ee9eb808de45c6c90670ab9c811a68d4df6be8c4a305f4e4b0c58826bf166f
ep_bytes: e863060000e978feffffcccccccccccc
timestamp: 2021-02-24 21:27:00

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: AcroTextExtractor
FileVersion: 21.1.20142.424128
LegalCopyright: Copyright 1984-2021 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename: AcroTextExtractor.exe
ProductName: Adobe Acrobat text extractor for non-PDF files
ProductVersion: 21.1.20142.424128
Translation: 0x0409 0x04b0

Worm.VB also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Fugrafa.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fugrafa.213388
FireEye	Gen:Variant.Fugrafa.213388
McAfee	Artemis!F96746DC51EF
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Fugrafa.213388
Cyren	W32/Fugrafa.AB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Rising	Worm.VB!1.DA41 (CLOUD)
Ad-Aware	Gen:Variant.Fugrafa.213388
Emsisoft	Gen:Variant.Fugrafa.213388 (B)
McAfee-GW-Edition	BehavesLike.Win32.Autorun.vm
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Microsoft	Trojan:Win32/Wacatac.B!ml
Gridinsoft	Ransom.Win32.Wacatac.sa
GData	Win32.Trojan.PSE.136NMWS
VBA32	Worm.VB
ALYac	Gen:Variant.Fugrafa.213388
Malwarebytes	Malware.AI.3696146603
TrendMicro-HouseCall	TROJ_GEN.R03BH0CAB22
Yandex	Trojan.Agent!vGmSoUnC6tc
MAX	malware (ai score=81)
Fortinet	W32/Fugrafa.A069!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Worm.VB?

Worm.VB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X