Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Worm
Threat report

Worm.Win32.Vobfus.dglv removal instruction

Published May 4, 2024 Worm category 3 min read
Report context

What to verify before removal

Use this report for a controlled check of Worm.Win32.Vobfus.dglv removal instruction when the affected machine shows suspicious processes, dropped files, or payload delivery behavior. The goal is to verify the exact file and persistence path before quarantine.

Start by comparing the local file name with BE4F5D3C56754B47A875.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
BE4F5D3C56754B47A875.mlw
  • Compare the suspicious file name with BE4F5D3C56754B47A875.mlw.
  • Confirm the detection name matches Worm.Win32.Vobfus.dglv removal instruction before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Worm.Win32.Vobfus.dglv is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Worm.Win32.Vobfus.dglv virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • CAPE detected the embedded win api malware family
  • Attempts to disable Windows Auto Updates
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Worm.Win32.Vobfus.dglv?



File Info:

name: BE4F5D3C56754B47A875.mlw
path: /opt/CAPEv2/storage/binaries/65020e890d22ccb2c66be7b07f6b3d569e87eef6cdea91424a2b6ca42e3b94d9
crc32: BD40CEE2
md5: be4f5d3c56754b47a875b7b43bcad0f8
sha1: ecf8a4ca8592bbfe7bd1e71e575a11f956953c96
sha256: 65020e890d22ccb2c66be7b07f6b3d569e87eef6cdea91424a2b6ca42e3b94d9
sha512: 7f03ba47c32fee6725a5bbe4d92c023940fcc51327e156cc5a3dd280b5994a1fabcb61faaa3a4a7c1e01636bec6942d2e648e2d7c5a01de20ad65df1b0ea9e6f
ssdeep: 3072:wFnLD3FbyZMgSuuj6Uq6EGtCLBnkczjLqXs0EIdVN2z:uVuulq6YLBNzjLLwXN2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17A04C43D6740A73EE415C6F83C9B839054AD6D3626E1A41BFBC2271976F49F2A320793
sha3_384: 319301732908ee25d0c957fadb40ec6cb76cfd61a888b9ee8907c4d3b37abaebd8a4bd0b5a1884ec1ebdf0de5a717a74
ep_bytes: 68a8414000e8f0ffffff000048000000
timestamp: 2012-02-14 07:37:49


Version Info:

Translation: 0x0409 0x04b0
ProductName: hMJoFLwgi
FileVersion: 1.00
ProductVersion: 1.00
InternalName: swgwvK
OriginalFilename: swgwvK.exe

Worm.Win32.Vobfus.dglv also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
ClamAV Win.Trojan.VB-1577
CAT-QuickHeal Trojan.Beebone.D
Skyhigh BehavesLike.Win32.VBObfus.cm
ALYac Gen:Variant.Application.Symmi.11352
Malwarebytes Generic.Malware.AI.DDS
Sangfor Suspicious.Win32.Save.vb
K7AntiVirus EmailWorm ( 0054d10f1 )
BitDefender Gen:Variant.Application.Symmi.11352
K7GW EmailWorm ( 0054d10f1 )
Arcabit Trojan.Application.Symmi.D2C58
Baidu Win32.Trojan.Jorik.e
VirIT Trojan.Win32.SHeur4.QIU
Symantec W32.Changeup
tehtris Generic.Malware
ESET-NOD32 Win32/AutoRun.VB.ASG
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Worm.Win32.Vobfus.dglv
NANO-Antivirus Trojan.Win32.Inject.cihugt
ViRobot Worm.Win32.A.WBNA.188416.AKI
MicroWorld-eScan Gen:Variant.Application.Symmi.11352
Avast Win32:Regrun-MC [Trj]
Tencent Worm.Win32.Vobfus.n
Emsisoft Gen:Variant.Application.Symmi.11352 (B)
F-Secure Trojan.TR/Jorik.ejmj
DrWeb Trojan.VbCrypt.81
VIPRE Gen:Variant.Application.Symmi.11352
TrendMicro WORM_VOBFUS.SMAB
Trapmine malicious.high.ml.score
FireEye Generic.mg.be4f5d3c56754b47
Sophos Mal/VBCheMan-B
SentinelOne Static AI – Malicious PE
Google Detected
Avira TR/Jorik.ejmj
MAX malware (ai score=78)
Antiy-AVL Worm/Win32.WBNA.gen
Xcitium TrojWare.Win32.VB.AVA@4paxk7
Microsoft Worm:Win32/Vobfus!pz
ZoneAlarm Worm.Win32.Vobfus.dglv
GData Gen:Variant.Application.Symmi.11352
Varist W32/Vobfus.AI.gen!Eldorado
AhnLab-V3 Worm/Win32.WBNA.R20724
Acronis suspicious
McAfee VBObfus.dc
TACHYON Worm/W32.Vobfus.188416.C
VBA32 BScope.Trojan.VB.Diple.01583
Cylance unsafe
Panda Trj/Genetic.gen
TrendMicro-HouseCall WORM_VOBFUS.SMAB
Rising Worm.VobfusEx!1.99DB (CLASSIC)
Yandex Trojan.GenAsa!uxqnusyVOGs
Ikarus Worm.Win32.Vobfus
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/VBObfus.CM!tr
BitDefenderTheta Gen:NN.ZevbaF.36804.lm0@aODQgBji
AVG Win32:Regrun-MC [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/Vobfus.b0226a57

How to remove Worm.Win32.Vobfus.dglv?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.