Should I remove “Worm.Win32.Vobfus.cmuz”?

The Worm.Win32.Vobfus.cmuz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Win32.Vobfus.cmuz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm.Win32.Vobfus.cmuz?

File Info:
name: D1EF7240A6E2EC3D16ED.mlw
path: /opt/CAPEv2/storage/binaries/a77b2bcd74555fa87a643c470288ea1bc48410886a89f85e476b95aade9947a0
crc32: C6586FF0
md5: d1ef7240a6e2ec3d16ed018d1755b501
sha1: 0a2b2ca16c2768ac1310bd994536a169fd83b72b
sha256: a77b2bcd74555fa87a643c470288ea1bc48410886a89f85e476b95aade9947a0
sha512: 1709317bf0e029dded856a2788882d13d60584f1936db73841c6b68e883a0875daf89a1fe2f6f525a6a117983748311b36d9ac32c1130ceab50ce94ff21e033c
ssdeep: 6144:T3vJcSLnqtrZjQHhOWahvVJ+Q4179iWs7hWr5tZtFvkUOt8t9Zscf9d9Y9+80QWG:T3v2SLnqtt8s1w
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DA54922E7225E739D836D5F0348C13A650ED9932E5CB685FEBCBAA0936F0D926534343
sha3_384: c8d303399aeaf4d63c186cf0902fc8740133d16e6a98860cd575d5d0c111d19826ceb67b15e72ed846ff83e63a8e060a
ep_bytes: 68e8474000e8eeffffff000000000000
timestamp: 2012-06-13 09:56:23

Version Info:
Translation: 0x0409 0x04b0
Comments: Psychokinetic
CompanyName: riavevano
FileDescription: preponderation Haemodilution picaroon
LegalCopyright: Villose undercry
LegalTrademarks: oversteadfastness heftily
ProductName: Unridden
FileVersion: 3.01
ProductVersion: 3.01
InternalName: waccznbvatpvme
OriginalFilename: waccznbvatpvme.exe

Worm.Win32.Vobfus.cmuz also known as:

How to remove Worm.Win32.Vobfus.cmuz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.