Categories: Worm

Should I remove “Worm:Win32/Autorun!BA”?

The Worm:Win32/Autorun!BA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/Autorun!BA virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Sample contains Overlay data
  • Anomalous file deletion behavior detected (10+)
  • Enumerates running processes
  • Creates an autorun.inf file
  • Authenticode signature is invalid

How to determine Worm:Win32/Autorun!BA?


File Info:

name: 887331F2F932C23A96E8.mlwpath: /opt/CAPEv2/storage/binaries/fa1c018fcde2ca0cefb6349136d98ddf31b4aedc32bfb81a4eaa558b53453533crc32: F93DFA71md5: 887331f2f932c23a96e83af6b365d6a0sha1: 784cf16aa73aa6a0f8cc10f904ee0421c3c9aaddsha256: fa1c018fcde2ca0cefb6349136d98ddf31b4aedc32bfb81a4eaa558b53453533sha512: debe31bf6a0c689ec4b9607981fb4c0c90524ab8388ce358dbe9b24faa18af650dddd9b56eca23d487b263fa63ff7b10163af651d4766bc79b9c33f044dc8e3dssdeep: 1536:aqVFAY7hslYDZ4Ny7SIn9uGBRTgqlyDwNSUbnXTn+ekorDfUwh5VoQ:fAyCM7SI0ann+hodh5Votype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T170146B1032D2C4B3E14610754816CBB66E6AFC755F296EC77BC5377E4F362C29A3A282sha3_384: aef023a884571473d90633fb8b3cd5949e1e0f89cd94fc6bfc1b2b2ced965d6a21685391ac2c539f5703b80c59ac67e5ep_bytes: e88a810000e978feffff8bff558bec8btimestamp: 2007-11-19 12:59:48

Version Info:

0: [No Data]

Worm:Win32/Autorun!BA also known as:

Bkav W32.AIDetect.malware2
Lionic Virus.Win32.AutoIt.n!c
MicroWorld-eScan Dropped:Worm.Autorun.VCD
FireEye Generic.mg.887331f2f932c23a
ALYac Dropped:Worm.Autorun.VCD
Cylance Unsafe
Zillya Virus.Autoit.Win32.10
Sangfor Worm.Win32.Autorun.gen
K7AntiVirus P2PWorm ( 00460ab21 )
Alibaba Worm:Win32/Autorun.28fb0719
K7GW P2PWorm ( 00460ab21 )
Cybereason malicious.2f932c
Baidu Win32.Worm.AutoRun.fm
VirIT Worm.Win32.Autorun.DL
Cyren W32/Worm.LZKV-4054
Symantec W32.SillyFDC
Elastic malicious (high confidence)
ESET-NOD32 Win32/AutoRun.FN
APEX Malicious
Paloalto generic.ml
ClamAV Win.Worm.Autorun-10784
Kaspersky Virus.Win32.AutoIt.e
BitDefender Dropped:Worm.Autorun.VCD
Avast Win32:AutoRun-RO [Wrm]
Tencent Win32.Virus.Autoit.Ebgt
Ad-Aware Dropped:Worm.Autorun.VCD
Sophos Mal/Generic-R + W32/Autorun-AJR
Comodo Worm.Win32.AutoRun.FN@31nq
F-Secure Trojan.TR/Spy.Zbot.KN.1
DrWeb Win32.HLLW.Autoruner.3906
VIPRE Dropped:Worm.Autorun.VCD
McAfee-GW-Edition BehavesLike.Win32.ZBot.dt
Emsisoft Dropped:Worm.Autorun.VCD (B)
GData Dropped:Worm.Autorun.VCD
Jiangmin Worm/AutoIt.c
Avira TR/Spy.Zbot.KN.1
Antiy-AVL Trojan/Generic.ASBOL.C69
Arcabit Worm.Autorun.VCD
ViRobot Worm.Win32.Autorun.126976.C
ZoneAlarm Virus.Win32.AutoIt.e
Microsoft Worm:Win32/Autorun.gen!BA
Cynet Malicious (score: 100)
AhnLab-V3 Worm/Win32.AutoRun.R76837
McAfee PWS-Zbot.gen.kn
MAX malware (ai score=100)
VBA32 BScope.Trojan.Wacatac
Malwarebytes Worm.AutoRun
TrendMicro-HouseCall WORM_AUTORUN.AEG
Rising Worm.Win32.Autorun.jwa (CLASSIC)
Yandex Trojan.GenAsa!4zUPhx4cXco
MaxSecure Virus.W32.AutoIT.E
Fortinet W32/Autorun.BL!tr
BitDefenderTheta AI:Packer.99E6C6041F
AVG Win32:AutoRun-RO [Wrm]
Panda W32/Autorun.ASM
CrowdStrike win/malicious_confidence_70% (W)

How to remove Worm:Win32/Autorun!BA?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

WebWatcher.Spyware.Monitor.DDS removal

The WebWatcher.Spyware.Monitor.DDS is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

What is “Lazy.519114”?

The Lazy.519114 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Should I remove “Malware.AI.3622831725”?

The Malware.AI.3622831725 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

What is “Generic.Dacic.94CCEEA9.A.B2226F8C (B)”?

The Generic.Dacic.94CCEEA9.A.B2226F8C (B) is considered dangerous by lots of security experts. When this infection is…

2 hours ago

What is “Tedy.577368”?

The Tedy.577368 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

MSIL/TrojanDownloader.Agent.QRC removal tips

The MSIL/TrojanDownloader.Agent.QRC is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago