Should I remove “Worm:Win32/Autorun.AGY”?

The Worm:Win32/Autorun.AGY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Autorun.AGY virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Enumerates running processes
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Attempts to modify desktop wallpaper
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Performs a large number of encryption calls using the same key possibly indicative of ransomware file encryption behavior
• Exhibits behavior characteristics of BlackRemote/BlackRAT RAT

How to determine Worm:Win32/Autorun.AGY?

File Info:
name: 48E67A9226CB2A6755ED.mlw
path: /opt/CAPEv2/storage/binaries/205b87c3876e55a7442571b63f88d373e121cf8d891c7313228cd1e2390debe0
crc32: 11BAB09A
md5: 48e67a9226cb2a6755edc3f4be80d98e
sha1: ed6db4b792cffea3c3d8846c89c24c0c0e083d39
sha256: 205b87c3876e55a7442571b63f88d373e121cf8d891c7313228cd1e2390debe0
sha512: 067424bf62b19049704baaad99353191f76fb41931057cca583df6bf3747c8955e4677e96979189e287d90ae0474ca9d931d690d0963235adcbb904fbe23924b
ssdeep: 1536:Pz43i6EJ02LyV3kFdp+0zI1ZBjhRDmmHeIcinLJcoHQHF3i6EJ02LyV3rETNF8Js:PzLyV3kF21im+YLzLyV3ITNF8vzeX8y
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19F545B22F3648899F09290B13811C6BA8A46BC701949DE57F7837E4E39706E3D6F5B1F
sha3_384: 4108e52384ad4bc933dea5739b032ed080a7bf0aee751759045f96d4efd2e7f3135267187c05070ebb57b8fe6709398a
ep_bytes: 833c24fefc77fe8d6424cc8d006083ec
timestamp: 2007-02-09 08:12:03

Version Info:
CompanyName:  
ProductName: Windows Folder
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Windows Folder
OriginalFilename: Microsoft Corporation
Translation: 0x0409 0x04b0

Worm:Win32/Autorun.AGY also known as:

How to remove Worm:Win32/Autorun.AGY?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.