Worm

Worm:Win32/AutoRun!pz removal guide

Malware Removal

The Worm:Win32/AutoRun!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/AutoRun!pz virus can do?

  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Creates an autorun.inf file
  • Authenticode signature is invalid
  • Deletes executed files from disk

How to determine Worm:Win32/AutoRun!pz?


File Info:

name: A44A4DE136998171E18B.mlw
path: /opt/CAPEv2/storage/binaries/e77f3b6e65ffb6493c43338754f95f92bb48a2a5f4303d8ebb9bb16c807d5e45
crc32: AD65F471
md5: a44a4de136998171e18bd360be19fded
sha1: 6e1c8a00f9fb3fe350d1a4cd9422ceff4e9a367f
sha256: e77f3b6e65ffb6493c43338754f95f92bb48a2a5f4303d8ebb9bb16c807d5e45
sha512: c5f01a328e588ce5996abeff8d5c6ad65c677d7f6df0c36d2bca88c103ca6f931842d9f3a637aaf4ba0774cf017d1b2e23a2c28d45a388ac8502714f37e8c2d8
ssdeep: 6144:+BapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8+xLpIh9jhl:RpQD+mO5KWy/zrVbt4fcY7x9U9jv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FFB46C32A2F09437D1732B7C8D5BA6AC98267E103D28B8476BE91D4C5F3D781752B293
sha3_384: 55243c0439b34c0ce1c913dee5e418926c12cd7cfee44127e7649db37d6bb57850d0d6cfcab1a3bb0007bdec77b9b659
ep_bytes: 558bec83c4f0b840174600e87456faff
timestamp: 2004-05-04 03:43:21

Version Info:

0: [No Data]

Worm:Win32/AutoRun!pz also known as:

BkavW32.AIDetectMalware
MicroWorld-eScanGeneric.Dacic.6D934B1C.A.2A40EF24
FireEyeGeneric.mg.a44a4de136998171
SkyhighBehavesLike.Win32.Autorun.gh
McAfeeW32/Autorun.worm.br
MalwarebytesDelphi.Worm.AutoRun.DDS
ZillyaWorm.AutoRun.Win32.2488
SangforTrojan.Win32.Save.a
K7AntiVirusP2PWorm ( 000630621 )
K7GWP2PWorm ( 000630621 )
Cybereasonmalicious.0f9fb3
BitDefenderThetaGen:NN.ZelphiF.36744.EKW@ayLflEci
VirITWorm.Win32.AutoRun.DBXP
SymantecW32.SillyFDC
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/AutoRun.Delf.DE
APEXMalicious
TrendMicro-HouseCallTROJ_AGENT_048811.TOMB
ClamAVWin.Worm.Autorun-314
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Dacic.6D934B1C.A.2A40EF24
NANO-AntivirusTrojan.Win32.AutoRun.bynqc
AvastWin32:AutoRun-AOY [Wrm]
TencentTrojan.Win32.Autorun.wc
EmsisoftGeneric.Dacic.6D934B1C.A.2A40EF24 (B)
BaiduWin32.Worm.Autorun.s
F-SecureDropper.DR/Delphi.Gen
DrWebTrojan.DownLoad.30734
VIPREGeneric.Dacic.6D934B1C.A.2A40EF24
TrendMicroTROJ_AGENT_048811.TOMB
Trapminemalicious.moderate.ml.score
SophosMal/SillyFDC-A
IkarusWorm.Win32.AutoRun
JiangminWorm/AutoRun.zum
WebrootW32.Worm.Autorun.Gen
GoogleDetected
AviraDR/Delphi.Gen
VaristW32/AutoRun.AS.gen!Eldorado
Antiy-AVLWorm/Win32.AutoRun
Kingsoftmalware.kb.a.1000
MicrosoftWorm:Win32/AutoRun!pz
XcitiumWorm.Win32.AutoRun.~AIN@58y89
ArcabitGeneric.Dacic.6D934B1C.A.2A40EF24
ViRobotWorm.Win32.Autorun.465408
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataWin32.Worm.Autorun.AM
CynetMalicious (score: 100)
Acronissuspicious
VBA32Trojan.Delf.Autorun.0415
ALYacGeneric.Dacic.6D934B1C.A.2A40EF24
MAXmalware (ai score=83)
Cylanceunsafe
PandaTrj/Genetic.gen
ZonerTrojan.Win32.32639
RisingWorm.Autorun!1.9D28 (CLASSIC)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/CoinMiner.F
AVGWin32:AutoRun-AOY [Wrm]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Worm:Win32/AutoRun!pz?

Worm:Win32/AutoRun!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment