Worm.Win32.Vobfus.erzq information

The Worm.Win32.Vobfus.erzq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Win32.Vobfus.erzq virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Worm.Win32.Vobfus.erzq?

File Info:
name: 360FD2CF7BF4A6289675.mlw
path: /opt/CAPEv2/storage/binaries/66a22f1b0b1074652fe321c85ec16ab835b4617a8fc36a1f3e1bfb89f742e093
crc32: 4F80DE46
md5: 360fd2cf7bf4a6289675d076ce3fc592
sha1: 944599ba015a661294a28b2867c5a21f1a4f0dab
sha256: 66a22f1b0b1074652fe321c85ec16ab835b4617a8fc36a1f3e1bfb89f742e093
sha512: 3782f61831405f3bb90fea78e3e8b197ec18fafde2f5e88136dce3d1477c51d0b14fbe1d314d49f7d83cb289374c51e42bd3f2d763885690c62e1859a0844d20
ssdeep: 3072:Vj/M5AO+Mcy1imsW7A0g3XDYHYTvZm3ov5Q4/cMIVH5bEvhSSqeLSqnjYo7:ZkypFy1imdJgc4s2QRhH5IXV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D4347425A3D0FB3DE864C6F82944469048AAEE3768D2AC17F6D15B1677B1E47F220373
sha3_384: eb4606ef7bcb405b134b75f2fd7e49c9d27fe5eff2b43a36bb0e6cd79fa7727894e04bdbb2e64ffbb1e3ff28ef4f0e1d
ep_bytes: 68cc4e4000e8eeffffff000000000000
timestamp: 2012-06-07 20:29:37

Version Info:
Translation: 0x0409 0x04b0
Comments: Predefeat Causal
CompanyName: Denominava copyrightable oblongly
FileDescription: esthesiogen
LegalCopyright: presignificator ugualmente
LegalTrademarks: Antibishop dysphoric
ProductName: Smit tautonymic
FileVersion: 5.03
ProductVersion: 5.03
InternalName: rkkwunkfhp
OriginalFilename: rkkwunkfhp.exe

Worm.Win32.Vobfus.erzq also known as:

How to remove Worm.Win32.Vobfus.erzq?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.