Categories: Worm

Worm:Win32/VB.OH removal instruction

The Worm:Win32/VB.OH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/VB.OH virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
Installs itself for autorun at Windows startup
CAPE detected the shellcode get eip malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Worm:Win32/VB.OH?


File Info:
name: 7F2FD5B547C9900AB09F.mlwpath: /opt/CAPEv2/storage/binaries/9a51336e62c6f45193bb2535b169dc8db7308d778bffb200b6a8c653428a4294crc32: EAE5188Fmd5: 7f2fd5b547c9900ab09f1b45cfc8edcbsha1: f5a9f694f1d8bef8632eb5bf183442b79e150c58sha256: 9a51336e62c6f45193bb2535b169dc8db7308d778bffb200b6a8c653428a4294sha512: dbbbce15d98e0446b4135fdb4f2ae145702a0781d3d324cfc4ecfd6eb8aeb36be7b734ec027d8ea2a0b1d08104ecf3448339bcd6ca2a2fc373b9b1537ebab114ssdeep: 768:VdEfLA39Ye6QBicB7ETXQMAz50UgG0s8OQashljmC9pmizwhXWLLWHY9u1y:VdEjA3b6Q3B8Advj07ashlj9rdsGXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T161C30922B7C4B676C220CAF40A6286B4051BFC740A969D1BF7827B4B7BB5DD3B125707sha3_384: 6bc45da2959abb437d3e01c96492132e27ae4ad1938796d038c6532fc024e54750cc5b0e99087457fdc02af8140bb08cep_bytes: 6846f4400033c064ff3064892029f629timestamp: 1970-01-01 00:00:00
Version Info:
FileDescription: Microsoft Word DocumentTranslation: 0x0409 0x04b0

Worm:Win32/VB.OH also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.Texel.kYJD
tehtris	Generic.Malware
MicroWorld-eScan	Win32.Virtob.Gen.12
FireEye	Generic.mg.7f2fd5b547c9900a
CAT-QuickHeal	W32.Virut.D
Skyhigh	BehavesLike.Win32.Swisyn.ct
McAfee	W32/Generic.worm.b
Zillya	Worm.VB.Win32.1412
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Virus ( 00001b761 )
Alibaba	Worm:Win32/Detnat.a3a8489f
K7GW	Virus ( 00001b761 )
Cybereason	malicious.547c99
VirIT	Win32.Patched.C
Symantec	W32.SillyDC
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Luder.Gen
APEX	Malicious
TrendMicro-HouseCall	WORM_VB.SMA
ClamAV	Win.Worm.VB-475
Kaspersky	Worm.Win32.Detnat.f
BitDefender	Win32.Virtob.Gen.12
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Luder [Wrm]
Tencent	Malware.Win32.Gencirc.13ad1a39
Emsisoft	Win32.Virtob.Gen.12 (B)
F-Secure	Worm.WORM/Lina.B
DrWeb	Win32.HLLM.Generic.412
VIPRE	Win32.Virtob.Gen.12
TrendMicro	WORM_VB.SMA
Trapmine	malicious.high.ml.score
CMC	Generic.Win32.7f2fd5b547!CMCRadar
Sophos	Mal/Behav-043
Ikarus	Trojan-Dropper
Jiangmin	Worm/Detnat.ap
Webroot	Worm:Win32/VB
Google	Detected
Avira	WORM/Lina.B
Antiy-AVL	Worm/Win32.Detnat
Kingsoft	Win32.Virut.F.121344
Microsoft	Worm:Win32/VB.OH
Xcitium	Worm.Win32.Detnat.~AA@fpx2
Arcabit	Win32.Virtob.Gen.12
ZoneAlarm	Worm.Win32.Detnat.f
GData	Win32.Virtob.Gen.12
Cynet	Malicious (score: 100)
AhnLab-V3	HEUR/Fakon.mow.X1351
VBA32	Trojan.VBS.0644
ALYac	Win32.Virtob.Gen.12
MAX	malware (ai score=100)
Cylance	unsafe
Panda	W32/Agent.MXR.worm
Rising	Worm.VBInjectEx!1.99E6 (CLASSIC)
Yandex	Trojan.GenAsa!GvGGeEMOB3M
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/MetaCrypt.3
BitDefenderTheta	AI:FileInfector.C9457D4313
AVG	Win32:Luder [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Worm:Win/Luder.Gen