Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Worm
Threat report

About “Worm.Win32.Vobfus.eivd” infection

Published May 2, 2024 Worm category 3 min read
Report context

What to verify before removal

Use this report for a controlled check of About “Worm.Win32.Vobfus.eivd” infection when the affected machine shows suspicious processes, dropped files, or payload delivery behavior. The goal is to verify the exact file and persistence path before quarantine.

Start by comparing the local file name with 77FD010E9FA43F2864C4.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
77FD010E9FA43F2864C4.mlw
  • Compare the suspicious file name with 77FD010E9FA43F2864C4.mlw.
  • Confirm the detection name matches About “Worm.Win32.Vobfus.eivd” infection before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The Worm.Win32.Vobfus.eivd is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Worm.Win32.Vobfus.eivd virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • Attempts to disable Windows Auto Updates
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Worm.Win32.Vobfus.eivd?



File Info:

name: 77FD010E9FA43F2864C4.mlw
path: /opt/CAPEv2/storage/binaries/17eac354a079f0ab99c6adf3e6c899819b892d909a4a81c6efe34ac6d7bb79c1
crc32: 10F3A2F6
md5: 77fd010e9fa43f2864c4d304ef7087cb
sha1: fbe7a4d538f69a1bbf41e732ca7e2a987ddd1b93
sha256: 17eac354a079f0ab99c6adf3e6c899819b892d909a4a81c6efe34ac6d7bb79c1
sha512: bc68bd777fe9e9b874f62dd908185518a91a88fc172a7567a025c726c12f7e33766b2add6d32332076850914399292c19f269c44ea613cb79ec60f2840fa3bdc
ssdeep: 12288:AaD/MT/kWd4beHxJ0tLf7sGFxCtaJBZ+oacJJG:nQT/KI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18FA4EF16A9363439F353C4F3E6B14709A45A5D7963A0D5AFA2F0B60760F3A0798A433F
sha3_384: aa3bcd6e2724c39afd24e3c161bbd806c1a38e1316aa4b7ef7007af4309d8f7731b66726e72588275ace0d06d4dfd3f1
ep_bytes: 682c584000e8f0ffffff000000000000
timestamp: 2012-06-20 20:12:50


Version Info:

Translation: 0x0409 0x04b0
Comments: Memory Scan v1
CompanyName: Memory Scan v1
FileDescription: Memory Scan v1
LegalCopyright: Memory Scan v1
LegalTrademarks: Memory Scan v1
ProductName: Memory Scan v1
FileVersion: 5.06
ProductVersion: 5.06
InternalName: olfwdgix
OriginalFilename: olfwdgix.exe

Worm.Win32.Vobfus.eivd also known as:

Bkav W32.AIDetectMalware
Lionic Worm.Win32.WBNA.luev
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.VBInject.11
FireEye Generic.mg.77fd010e9fa43f28
CAT-QuickHeal Trojan.Beebone.D
Skyhigh BehavesLike.Win32.VBObfus.gm
McAfee VBObfus.eg
Malwarebytes Generic.Malware.AI.DDS
VIPRE Gen:Variant.VBInject.11
Sangfor Suspicious.Win32.Save.vb
K7GW Trojan ( 005640b91 )
K7AntiVirus Trojan ( 005640b91 )
Baidu Win32.Trojan.VBObfus.f
VirIT Trojan.Win32.Zyx.LO
Symantec W32.Changeup
ESET-NOD32 Win32/Pronny.BB
APEX Malicious
TrendMicro-HouseCall WORM_VOBFUS.SM01
Avast Win32:VB-ADLB [Trj]
ClamAV Win.Trojan.Vobfus-59
Kaspersky Worm.Win32.Vobfus.eivd
BitDefender Gen:Variant.VBInject.11
NANO-Antivirus Trojan.Win32.aryk.dtiygx
Tencent Worm.Win32.Vobfus.sq
TACHYON Trojan/W32.VB-Agent.475136.AT
Emsisoft Gen:Variant.VBInject.11 (B)
Google Detected
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.VbCrypt.60
TrendMicro WORM_VOBFUS.SM01
Sophos Mal/SillyFDC-W
SentinelOne Static AI – Suspicious PE
Webroot W32.Obfuscated.Gen
Varist W32/VBInject.BG.gen!Eldorado
Avira TR/Dropper.Gen
Antiy-AVL Worm/Win32.WBNA.gen
Kingsoft malware.kb.a.992
Microsoft Worm:Win32/Vobfus.FR
Xcitium TrojWare.Win32.VB.AVA@4paxk7
Arcabit Trojan.VBInject.11
ViRobot Worm.Win32.Agent.475136
ZoneAlarm Worm.Win32.Vobfus.eivd
GData Gen:Variant.VBInject.11
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Vobfus.R54173
Acronis suspicious
BitDefenderTheta Gen:NN.ZevbaF.36804.Dm0@aCUeiyfi
ALYac Gen:Variant.VBInject.11
MAX malware (ai score=87)
VBA32 TScope.Trojan.VB
Cylance unsafe
Panda Trj/Genetic.gen
Rising Worm.Pronny!1.E3E1 (CLASSIC)
Yandex Trojan.GenAsa!fPIaZcJbcYc
Ikarus Worm.Win32.Vobfus
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Vobfus.JYK!tr
AVG Win32:VB-ADLB [Trj]
DeepInstinct MALICIOUS
alibabacloud Worm:Win/Vobfus.d02db0a1

How to remove Worm.Win32.Vobfus.eivd?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.