Worm:Win32/Vobfus.CS malicious file

Malware Removal

The Worm:Win32/Vobfus.CS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Vobfus.CS virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

z.whorecord.xyz
a.tomx.xyz
ns1.player1532.com
ns1.videoall.org
ns1.videoall.net

How to determine Worm:Win32/Vobfus.CS?


File Info:

crc32: 27F5694F
md5: 9a3fc011b279ed494f12851ad63195e5
name: 9A3FC011B279ED494F12851AD63195E5.mlw
sha1: cf2e9d23933316b27695398638b59a95cd6bb5bc
sha256: 4c207a41fb06032939f9a54faafdbb00f89af5a8703006d4e84fafdad89077d2
sha512: 5fbfd90a5f33e65032ef2661b5e46342d2a8dad6840bbb0b6e29e6d7b01038901bc24e740dea45b90ee70c579afebbc6404e2a2dd304d98ee1a25e082e419cbd
ssdeep: 1536:S+cIRGlW9nRqp3E5zkons4MBikY+msHH0o4vwo3L2YRTB6m8AJ0SS:SF4nRQE5zkPBir+miUoUEYRTB6ZYS
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
ProductVersion: 1.00
InternalName: TUrLqeefWAnFmScIIp
FileVersion: 1.00
OriginalFilename: TUrLqeefWAnFmScIIp.exe
ProductName: ovoLdxIXJZYHVCX

Worm:Win32/Vobfus.CS also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.Conjar.1
FireEyeGeneric.mg.9a3fc011b279ed49
CAT-QuickHealTrojan.Beebone.D
Qihoo-360Win32/TrojanDownloader.Diple.HwMAB3EA
ALYacGen:Heur.Conjar.1
CylanceUnsafe
SangforWin.Trojan.Changeup-6169544-0
K7AntiVirusEmailWorm ( 0054d10f1 )
AlibabaWorm:Win32/Vobfus.47544f33
K7GWEmailWorm ( 0054d10f1 )
Cybereasonmalicious.1b279e
BitDefenderThetaAI:Packer.771101841F
CyrenW32/S-43739e52!Eldorado
SymantecW32.Changeup
BaiduWin32.Worm.Pronny.d
APEXMalicious
AvastWin32:Vitro [Inf]
ClamAVWin.Packer.VBCrypt-5731517-0
KasperskyWorm.Win32.Vobfus.ersn
BitDefenderGen:Heur.Conjar.1
NANO-AntivirusTrojan.Win32.WBNA.covkiz
Paloaltogeneric.ml
TencentWin32.Worm.Vobfus.Htmd
Ad-AwareGen:Heur.Conjar.1
TACHYONWorm/W32.VB-WBNA.147456.B
EmsisoftGen:Heur.Conjar.1 (B)
ComodoWorm.Win32.WBNA.BUL@4mk1d5
F-SecureTrojan.TR/Diple.eoynz
DrWebTrojan.VbCrypt.60
VIPRETrojan.Win32.SillyFDC.p (v)
TrendMicroWORM_VOBFUS.SMHE
McAfee-GW-EditionBehavesLike.Win32.VBObfus.ct
SophosML/PE-A + Mal/SillyFDC-T
SentinelOneStatic AI – Malicious PE – Worm
GDataGen:Heur.Conjar.1
AviraTR/Diple.eoynz
Antiy-AVLWorm/Win32.WBNA.gen
GridinsoftTrojan.Win32.Downloader.oa
ArcabitTrojan.Conjar.1
ZoneAlarmWorm.Win32.Vobfus.ersn
MicrosoftWorm:Win32/Vobfus.CS
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.VBKrypt.R117465
Acronissuspicious
McAfeeVBObfus.g
MAXmalware (ai score=89)
VBA32TScope.Trojan.VB
MalwarebytesGeneric.Trojan.Malicious.DDS
ESET-NOD32a variant of Win32/Pronny.CD
TrendMicro-HouseCallWORM_VOBFUS.SMHE
YandexTrojan.GenAsa!wxeafdy0FYg
IkarusVirus.Worm.SuspectCRC
eGambitUnsafe.AI_Score_99%
FortinetW32/VBObfus.G!tr
AVGWin32:Vitro [Inf]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.121218.susgen

How to remove Worm:Win32/Vobfus.CS?

Worm:Win32/Vobfus.CS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment