Worm:Win32/Vobfus.BQ removal

The Worm:Win32/Vobfus.BQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.BQ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Vobfus.BQ?

File Info:
name: C5320EB16BF8078E18F8.mlw
path: /opt/CAPEv2/storage/binaries/68490e1ca7e67314c9acf7e1996736c9c8c4b9d0aa0ccf3618e4adb9455b9971
crc32: 92AE6E5C
md5: c5320eb16bf8078e18f878fed605ab31
sha1: ec7fade7828f823322e796eb8890fec3c1aeebe3
sha256: 68490e1ca7e67314c9acf7e1996736c9c8c4b9d0aa0ccf3618e4adb9455b9971
sha512: f194bd189c47c7f0b1679494c1e3d7aa3239ac695b2cb9df65a8098891302701ed943acc34c26c12e4cd8603d9de6f7318eed6c748a53dc8be4164c22d85cb57
ssdeep: 6144:yei3dISHoBrxslc5FNUAgnIiNHwjypw1y4RP49RpHref3lv6eIvM:yeSdALslMLb749RpHref3l2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13444EC52B210B63BE062E5F6B554C74BA2213D778BA46C13B6C51B4B90B06E3B9F074F
sha3_384: 0ded2188c9da53868dacf7695588a1ab082fcc7e5cb49eaf3c7d5394bf35813b2981fa07fddce4df077200e967caa54a
ep_bytes: 68c4414000e8eeffffff000000000000
timestamp: 2011-03-26 15:55:40

Version Info:
Translation: 0x0409 0x04b0
ProductName: HIAGCtQohxnrpbrVbnRyvJkwLtXA
FileVersion: 1.26
ProductVersion: 1.26
InternalName: YQODfsdL
OriginalFilename: YQODfsdL.exe

Worm:Win32/Vobfus.BQ also known as:

How to remove Worm:Win32/Vobfus.BQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.