Worm

Worm:Win32/AutoRun!pz (file analysis)

Malware Removal

The Worm:Win32/AutoRun!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/AutoRun!pz virus can do?

  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Creates an autorun.inf file
  • Authenticode signature is invalid
  • Deletes executed files from disk

How to determine Worm:Win32/AutoRun!pz?


File Info:

name: 512263ABB85830BBBB26.mlw
path: /opt/CAPEv2/storage/binaries/84d2ae2b94af8b41549ae79ddad9abe5f3067288f7f8951451530c68ff4e3b54
crc32: 8A14F86B
md5: 512263abb85830bbbb26eda097718c77
sha1: c59cb15ec2e39993ae242e822089e619d59836bc
sha256: 84d2ae2b94af8b41549ae79ddad9abe5f3067288f7f8951451530c68ff4e3b54
sha512: a3ad407032ad2f73313e722cc9a8ba5a9e8add4e0dc5e9f344f2f8703c4fd4abedb1017a821d051720bf3aed1b3cec78f3468fdbeccc185135f66b7af71ab866
ssdeep: 6144:+BapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8+mLpIh9jhl:RpQD+mO5KWy/zrVbt4fcY7m9U9jv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11AB46C32A2F09437D1732B7C8D5BA6AC98267E103D28B8476BE91D4C5F3D781752B293
sha3_384: 1e415306395509e8aff1744edadf69917730a6af0f1ccca877acec01109bccc1a4f01d56373c4369318e591ac8339b65
ep_bytes: 558bec83c4f0b840174600e87456faff
timestamp: 2004-05-04 03:43:21

Version Info:

0: [No Data]

Worm:Win32/AutoRun!pz also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
DrWebTrojan.DownLoad.30734
MicroWorld-eScanGeneric.Dacic.6D934B1C.A.2A40EF24
ClamAVWin.Worm.Autorun-314
FireEyeGeneric.mg.512263abb85830bb
CAT-QuickHealWorm.AutoRun
SkyhighBehavesLike.Win32.Autorun.gh
McAfeeW32/Autorun.worm.br
MalwarebytesDelphi.Worm.AutoRun.DDS
VIPREGeneric.Dacic.6D934B1C.A.2A40EF24
SangforTrojan.Win32.Save.a
K7AntiVirusP2PWorm ( 000630621 )
K7GWP2PWorm ( 000630621 )
Cybereasonmalicious.ec2e39
BitDefenderThetaGen:NN.ZelphiF.36744.EKW@ayLflEci
VirITWorm.Win32.AutoRun.DBXP
SymantecW32.SillyFDC
ESET-NOD32a variant of Win32/AutoRun.Delf.DE
ZonerTrojan.Win32.32639
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Dacic.6D934B1C.A.2A40EF24
NANO-AntivirusTrojan.Win32.AutoRun.bynqc
AvastWin32:AutoRun-AOY [Wrm]
TencentTrojan.Win32.Autorun.wc
EmsisoftGeneric.Dacic.6D934B1C.A.2A40EF24 (B)
F-SecureDropper.DR/Delphi.Gen
BaiduWin32.Worm.Autorun.s
ZillyaWorm.AutoRun.Win32.2488
TrendMicroTROJ_AGENT_048811.TOMB
Trapminemalicious.moderate.ml.score
SophosMal/SillyFDC-A
IkarusWorm.Win32.AutoRun
GDataWin32.Worm.Autorun.AM
JiangminWorm/AutoRun.zum
WebrootW32.Worm.Autorun.Gen
GoogleDetected
AviraDR/Delphi.Gen
MAXmalware (ai score=83)
Antiy-AVLWorm/Win32.AutoRun
Kingsoftmalware.kb.a.1000
XcitiumWorm.Win32.AutoRun.~AIN@58y89
ArcabitGeneric.Dacic.6D934B1C.A.2A40EF24
ViRobotWorm.Win32.Autorun.465408
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftWorm:Win32/AutoRun!pz
VaristW32/AutoRun.AS.gen!Eldorado
Acronissuspicious
VBA32Trojan.Delf.Autorun.0415
ALYacGeneric.Dacic.6D934B1C.A.2A40EF24
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_AGENT_048811.TOMB
RisingWorm.Autorun!1.9D28 (CLASSIC)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/CoinMiner.F
AVGWin32:AutoRun-AOY [Wrm]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Worm:Win32/AutoRun!pz?

Worm:Win32/AutoRun!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment