Worm

Worm:Win32/Mofksys!pz removal tips

Malware Removal

The Worm:Win32/Mofksys!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/Mofksys!pz virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Worm:Win32/Mofksys!pz?


File Info:

name: 07A4CBA5F65246AE2669.mlw
path: /opt/CAPEv2/storage/binaries/77ba1de7e7326d4d16ae2868c1cbd363b2430f2cad248f927467c354a369b6a6
crc32: B78F9F97
md5: 07a4cba5f65246ae266960e98bd1f655
sha1: 8b38340f5f5fe1404bf13d1f454c558f94bf9bbb
sha256: 77ba1de7e7326d4d16ae2868c1cbd363b2430f2cad248f927467c354a369b6a6
sha512: 5e42245891c0a0216e4f944163096f7e253d036a3396330908c1c10f84271811bb47a807adbae532788437010ebb4e8825ad21971a5be4bbd97d68e0dd2e44a2
ssdeep: 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV89:UVqoCl/YgjxEufVU0TbTyDDalC9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T190D308237E94505EE821C9F138A5DAAEB8230E361BE46D1B7767BB042571603B2F520F
sha3_384: 0bfff2096fda44094f0bf0638a7bac5c778cc94e60ae086b80c712cef3b586b65100c2b4f23efbc7e3f76b6bb80ca01b
ep_bytes: 68dc3a4000e8eeffffff000048000000
timestamp: 2013-04-01 07:08:22

Version Info:

Translation: 0x0409 0x04b0
ProductName: Project1
FileVersion: 1.00
ProductVersion: 1.00
InternalName: TJprojMain
OriginalFilename: TJprojMain.exe

Worm:Win32/Mofksys!pz also known as:

BkavW32.WatermarkHQc.PE
Elasticmalicious (high confidence)
DrWebWin32.HLLP.Swisyn
MicroWorld-eScanWin32.Gosys.B
CAT-QuickHealW32.Mofksys.A4
SkyhighBehavesLike.Win32.Swisyn.cm
ALYacWin32.Gosys.B
MalwarebytesGeneric.Malware.AI.DDS
VIPREWin32.Gosys.B
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 00579e181 )
K7GWTrojan ( 0058e74a1 )
Cybereasonmalicious.f5f5fe
ArcabitWin32.Gosys.B
BitDefenderThetaAI:Packer.FB4C4F7A20
VirITTrojan.Win32.Agent4.ALYU
SymantecW32.Gosys
tehtrisGeneric.Malware
ESET-NOD32Win32/VB.NBI
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.VBGeneric-6735875-0
KasperskyVirus.Win32.VB.mz
BitDefenderWin32.Gosys.B
NANO-AntivirusTrojan.Win32.Swisyn.flhacn
AvastWin32:VB-OJQ [Wrm]
TencentWorm.Win32.Wbna.wf
EmsisoftWin32.Gosys.B (B)
F-SecureTrojan.TR/Patched.Ren.Gen
BaiduWin32.Worm.VB.b
ZillyaVirus.HLLP.Win32.1
TrendMicroPE_SWISB.A-O
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.07a4cba5f65246ae
SophosTroj/Agent-ABZF
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Agent.hxgb
WebrootW32.Trojan.Gen
VaristW32/Trojan.UEJO-9077
AviraTR/Patched.Ren.Gen
MAXmalware (ai score=84)
Antiy-AVLTrojan/Win32.Agent
Kingsoftmalware.kb.a.1000
XcitiumTrojWare.Win32.VB.QOTY@4qfd0g
MicrosoftWorm:Win32/Mofksys!pz
ZoneAlarmVirus.Win32.VB.mz
GDataWin32.Trojan.PSE1.1NLNP9O
GoogleDetected
AhnLab-V3Worm/Win32.Mofksys.R198176
Acronissuspicious
McAfeeW32/Swisyn.b
TACHYONWorm/W32.VB-Mofksys.Zen
VBA32TScope.Trojan.VB
Cylanceunsafe
PandaTrj/Spy.AT
ZonerTrojan.Win32.88925
TrendMicro-HouseCallPE_SWISB.A-O
RisingTrojan.Agent!1.6A70 (CLASSIC)
IkarusWorm.Mofksys
MaxSecureVirus.W32.Agent.xjgj
FortinetW32/VB.QCC!tr.dldr
AVGWin32:VB-OJQ [Wrm]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Worm:Win32/Mofksys!pz?

Worm:Win32/Mofksys!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment