How to remove “Worm.Win32.Vobfus.erzq”?

The Worm.Win32.Vobfus.erzq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm.Win32.Vobfus.erzq virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Worm.Win32.Vobfus.erzq?

File Info:
name: AC1A191DCAFF3790BC09.mlw
path: /opt/CAPEv2/storage/binaries/08f8cc2a5f19b74dfbe84219fc1141e473b399b0f9ab79cb5abe121e4d89b40e
crc32: DF1A90A7
md5: ac1a191dcaff3790bc094c58f732fed1
sha1: 4938f0d7d81c7c44e50c3096bd2b5e14ea5166e7
sha256: 08f8cc2a5f19b74dfbe84219fc1141e473b399b0f9ab79cb5abe121e4d89b40e
sha512: e76f47a98ddf608c5c60a468ad71446cf1082e0d4486a86ec756c6407e122b0c2eb9efdd1575796aecce60b1e8bc0a499171567539167ec5bed5be668b6fb518
ssdeep: 3072:VjIMSAO/Mcy1imsW7A0g3XDYHYTvZm3ov5Q4/cMIVH5bEvhSSqeLSqnjYJC:Z770Fy1imdJgc4s2QRhH5IXF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EC347425A3D0FB3DE860C6F82944469048AAEE3768D2AC17F6D15B1677B1E47F220773
sha3_384: c65c1ce2f2f846e1875d90a576a169ad62f47a86c7b2040dbaf4f90efe98456f79cc795972e2c6ba233f50fecf2b23ea
ep_bytes: 68cc4e4000e8eeffffff000000000000
timestamp: 2012-06-07 20:29:37

Version Info:
Translation: 0x0409 0x04b0
Comments: Predefeat Causal
CompanyName: Denominava copyrightable oblongly
FileDescription: esthesiogen
LegalCopyright: presignificator ugualmente
LegalTrademarks: Antibishop dysphoric
ProductName: Smit tautonymic
FileVersion: 5.03
ProductVersion: 5.03
InternalName: kmhjkzccda
OriginalFilename: kmhjkzccda.exe

Worm.Win32.Vobfus.erzq also known as:

How to remove Worm.Win32.Vobfus.erzq?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.