Categories: Worm

Worm:BAT/Autorun.W removal guide

The Worm:BAT/Autorun.W is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:BAT/Autorun.W virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
A process created a hidden window
Executed a command line with /V argument which modifies variable behaviour and whitespace allowing for increased obfuscation options
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Created a process from a suspicious location

How to determine Worm:BAT/Autorun.W?


File Info:
name: 406CC4BE88F80D52700D.mlwpath: /opt/CAPEv2/storage/binaries/7ec0e1af9783d4d8bd8386b0228cdb1deb784f69a41bca13d07789adafd58ac6crc32: A3FC501Bmd5: 406cc4be88f80d52700d426ab2e7278esha1: 6a2f2099f4883ee668605b6fb5f9140b6ad14519sha256: 7ec0e1af9783d4d8bd8386b0228cdb1deb784f69a41bca13d07789adafd58ac6sha512: 47cdfc7ab0583f2dc57ef883e99300a5e78ed85fb00928de44e75cdc255252d59e8b7e1cd5ab4fbbadada5e549d1dae1cb8a2ec9d243707857c2fe152c6e1b30ssdeep: 768:/1L5jeeD7XyzQpeY52OnJl9z6R0KTZIFklU7DuUZeJaIGO:/1NjeUeW52O9z6R7tl5UWVGOtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15D23AEB5B293E6DAC0644174CF0EF63251A69F52241083A9F6C97F3F7E712AC8D0B961sha3_384: f28260e6969c4d867fd5f86bf2ef18f4119a33293f42ed6c44b346e50fdf91f2019b146d1dcce4fc19aed48722963032ep_bytes: 60e80000000058055a0b00008b3003f0timestamp: 2011-03-25 13:17:42
Version Info:
0: [No Data]

Worm:BAT/Autorun.W also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	GenPack:Generic.Malware.SBV.357C4BDD
FireEye	Generic.mg.406cc4be88f80d52
McAfee	Artemis!406CC4BE88F8
Cylance	Unsafe
K7AntiVirus	Trojan ( 000ee3fc1 )
Alibaba	Worm:BAT/Autorun.dad88261
K7GW	Trojan ( 000ee3fc1 )
Cybereason	malicious.e88f80
Cyren	W32/CoinMiner.AP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	BAT/Disabler.NAC
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Agent.xaknoi
BitDefender	GenPack:Generic.Malware.SBV.357C4BDD
NANO-Antivirus	Trojan.Win32.Disabler.emeazj
Avast	FileRepMalware
Tencent	Bat.Trojan.Disabler.Paca
Ad-Aware	GenPack:Generic.Malware.SBV.357C4BDD
Emsisoft	GenPack:Generic.Malware.SBV.357C4BDD (B)
Comodo	TrojWare.Win32.CoinMiner.IEGT@57p1bc
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DJU21
McAfee-GW-Edition	BehavesLike.Win32.Generic.ph
Sophos	Mal/Generic-S
Ikarus	Trojan.BAT.Disabler
GData	GenPack:Generic.Malware.SBV.357C4BDD
Webroot	W32.Malware.Gen
Avira	BAT/Disabler.EB.1
MAX	malware (ai score=84)
Microsoft	Worm:BAT/Autorun.W
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C2214988
Acronis	suspicious
VBA32	Hoax.Blocker
ALYac	GenPack:Generic.Malware.SBV.357C4BDD
TrendMicro-HouseCall	TROJ_GEN.R002C0DJU21
Yandex	Packed/MPress
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	BAT/Disabler.NAC!tr
AVG	FileRepMalware
Panda	Trj/CI.A