About “Worm:Win32/Vobfus.AN” infection

The Worm:Win32/Vobfus.AN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.AN virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Vobfus.AN?

File Info:
name: EA1E25FD2718A022BA01.mlw
path: /opt/CAPEv2/storage/binaries/2d004a2a2852a7642dffa8e8d2c1b560c38dc96c7422a0a30ce3b7d3cb2c1a5c
crc32: 80EFE02A
md5: ea1e25fd2718a022ba017ce6e6e385b3
sha1: 80ade2fb356cc700b3564dca4ae53fe0609b9b0c
sha256: 2d004a2a2852a7642dffa8e8d2c1b560c38dc96c7422a0a30ce3b7d3cb2c1a5c
sha512: 322703a877c502f692fa6b883ee04871145816d8f8d9f37d86f2fd6af60c3ddf1458414bb32872b4f935891e2a989f366cd2e5596504b1ccd42135450c476baf
ssdeep: 768:FwYOhAjPJZdr+KGz5BAtpm4eutfrWTVtTZ/BliKG1jiTa9McTfkQ3sqrAC:Wa3dS6pm4aTZ5XG1jiTa9McrkQ8W
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16493421F73413598E51915F53A8EC2D7A2E6A4FC8A1751C2CB753958A82CF3B2C08DAF
sha3_384: 9a89160a1a07a2b15ea6d428a5e33ca26bd5f8cbd930a65baf4d0b0429a4764d5041b8143a709a0c80aa12276825a05f
ep_bytes: 6878114000e8f0ffffff000000000000
timestamp: 2010-11-24 13:55:18

Version Info:
Translation: 0x0409 0x04b0
ProductName: AnyyPO
FileVersion: 3.44
ProductVersion: 3.44
InternalName: AnyyP
OriginalFilename: AnyyP.exe

Worm:Win32/Vobfus.AN also known as:

How to remove Worm:Win32/Vobfus.AN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.