Worm:Win32/Slenfbot removal instruction

The Worm:Win32/Slenfbot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Slenfbot virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes its original binary from disk
• Checks for the presence of known windows from debuggers and forensic tools
• Likely virus infection of existing system binary
• Attempts to identify installed analysis tools by a known file location
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Worm:Win32/Slenfbot?

File Info:
name: 3D30E667C48BA38718C4.mlw
path: /opt/CAPEv2/storage/binaries/8acf98bc4c4c9ab6ae175d6d222e86979963a42a297133db8cbcd6b37d807b01
crc32: 9523F6F5
md5: 3d30e667c48ba38718c45d6e88a339ba
sha1: 156035e6655bad0d2621ecf3466360d529a1de6e
sha256: 8acf98bc4c4c9ab6ae175d6d222e86979963a42a297133db8cbcd6b37d807b01
sha512: 545cd2a1d9f128d393ce96365cec0d65fb3200feef30b171eb7d4f0e3b167728e7372cfac666df320967df9fb3b8c8e27689ea32a9c454e3a25bf0e8f973281e
ssdeep: 6144:S9+Varp/6LNZOlu89Yqgd4QFD7uVbe++Bdsn:LVNwqHQhbn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17C24025EE3505665DAEFC3B16959CB108D704194AF35023FC4FEBF66FE7089A830A42A
sha3_384: 3b03d519f522a91f7d3f44b2a5f72e82d2826754293a3d6084b91233af496506220501fbe858af971c9d85c4403180fb
ep_bytes: 60be006045008dbe00b0faff57eb0b90
timestamp: 2006-07-03 08:10:16

Version Info:
CompanyName: MoRUN.net
FileDescription: MoRUN.net Sticker Lite
FileVersion: 6.3
InternalName: Sticker.exe
LegalCopyright: 2002-2010 (c) MoRUN.net.  All rights reserved.
OriginalFilename: Sticker.exe
ProductName: MoRUN.net Sticker Lite
ProductVersion: 6.3
Translation: 0x0409 0x04e4

Worm:Win32/Slenfbot also known as:

How to remove Worm:Win32/Slenfbot?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.