Worm

Worm:Win32/AutoRun!pz removal instruction

Malware Removal

The Worm:Win32/AutoRun!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/AutoRun!pz virus can do?

  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Creates an autorun.inf file
  • Authenticode signature is invalid
  • Deletes executed files from disk

How to determine Worm:Win32/AutoRun!pz?


File Info:

name: BC272394F4BDFCD9D331.mlw
path: /opt/CAPEv2/storage/binaries/5f78f15854517be10d9071ffdb66bdc3e6a51b53207b328fb0a10fa48fc1859b
crc32: FAFC3727
md5: bc272394f4bdfcd9d331a9b5e61a9062
sha1: 7b05cca4d070ff8df13e89e72c339d12420e0853
sha256: 5f78f15854517be10d9071ffdb66bdc3e6a51b53207b328fb0a10fa48fc1859b
sha512: 5a7d5863c861cb9541f5184ec45b60eed4a298534a043ccacd666ab2f278c828d1ec8d904964094b235a4718d8627ce1dc9717572661d3f284c051e1f2450bfe
ssdeep: 6144:EBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8+ALpIh9jhl:zpQD+mO5KWy/zrVbt4fcY7A9U9jv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19BA46C32A2F09437D1732B7C8D5BA6AC98267E103D28B8476BE91D4C5F3D781752B293
sha3_384: 96dc6de6c9286fdefe73880bea0e7ea2dbe5efb0284fb71dfcfe16dec2ec39433210dcd3e9a5092dca81a104b04f005d
ep_bytes: 558bec83c4f0b840174600e87456faff
timestamp: 2006-08-28 01:16:55

Version Info:

0: [No Data]

Worm:Win32/AutoRun!pz also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGeneric.Dacic.6D934B1C.A.A3F6C4BC
FireEyeGeneric.mg.bc272394f4bdfcd9
CAT-QuickHealWorm.Autorun.RE8
SkyhighBehavesLike.Win32.Autorun.gh
McAfeeW32/Autorun.worm.br
MalwarebytesDelphi.Worm.AutoRun.DDS
VIPREGeneric.Dacic.6D934B1C.A.A3F6C4BC
SangforTrojan.Win32.Save.a
K7AntiVirusP2PWorm ( 000630621 )
K7GWP2PWorm ( 000630621 )
CrowdStrikewin/malicious_confidence_100% (W)
BaiduWin32.Worm.Autorun.s
VirITWorm.Win32.AutoRun.DBXP
SymantecW32.SillyFDC
ESET-NOD32a variant of Win32/AutoRun.Delf.DE
APEXMalicious
ClamAVWin.Worm.Autorun-314
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Dacic.6D934B1C.A.A3F6C4BC
NANO-AntivirusTrojan.Win32.AutoRun.bynqc
AvastWin32:AutoRun-AOY [Wrm]
TencentTrojan.Win32.Autorun.wc
SophosMal/SillyFDC-A
F-SecureDropper.DR/Delphi.Gen
DrWebTrojan.DownLoad.30734
ZillyaWorm.AutoRun.Win32.2488
TrendMicroTROJ_AGENT_048811.TOMB
EmsisoftGeneric.Dacic.6D934B1C.A.A3F6C4BC (B)
SentinelOneStatic AI – Malicious PE
MAXmalware (ai score=82)
GDataWin32.Worm.Autorun.AM
JiangminWorm/AutoRun.zum
WebrootW32.Worm.Autorun.Gen
GoogleDetected
AviraDR/Delphi.Gen
VaristW32/AutoRun.AS.gen!Eldorado
Antiy-AVLWorm/Win32.AutoRun
XcitiumWorm.Win32.AutoRun.~AIN@58y89
ArcabitGeneric.Dacic.6D934B1C.A.A3F6C4BC
ViRobotWorm.Win32.Autorun.465408
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftWorm:Win32/AutoRun!pz
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.AutoRun.C65764
Acronissuspicious
BitDefenderThetaGen:NN.ZelphiF.36744.CGW@a4UmAAoi
ALYacGeneric.Dacic.6D934B1C.A.A3F6C4BC
TACHYONTrojan/W32.DP-Agent.471552.M
VBA32Trojan.Delf.Autorun.0415
Cylanceunsafe
PandaTrj/Genetic.gen
ZonerTrojan.Win32.32639
TrendMicro-HouseCallTROJ_AGENT_048811.TOMB
RisingWorm.Autorun!1.9D28 (CLASSIC)
YandexTrojan.GenAsa!9k+zEyzUElM
IkarusWorm.Win32.AutoRun
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/AutoRun.QGG!worm
AVGWin32:AutoRun-AOY [Wrm]
Cybereasonmalicious.4d070f
DeepInstinctMALICIOUS

How to remove Worm:Win32/AutoRun!pz?

Worm:Win32/AutoRun!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment