Worm:Win32/Vobfus.DA information

Malware Removal

The Worm:Win32/Vobfus.DA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Vobfus.DA virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Zeus P2P (Banking Trojan)
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

ns1.player1532.com
ns1.videoall.org
ns1.videoall.net

How to determine Worm:Win32/Vobfus.DA?


File Info:

crc32: E8400BFD
md5: 37218cebea471850c87f72362cca1c65
name: 37218CEBEA471850C87F72362CCA1C65.mlw
sha1: 8756ce5bb1b8c0c468770d3618fb7745a794f756
sha256: 63a53a329d986c291132acd8cce2278be7752a61ddf4299b5562df037dbbe833
sha512: a8fd994ddfd8beaa4ea3786a7a326c62f01fcdda15f09aab9f1df7e161698cdd34bfb871bd30d7df6a3709372d2763943b714bd4b6a89e435dd7cc4e18de6ac0
ssdeep: 3072:BQsKeCoHwmFKULQIyZeIJ5jeL1ps/efrKqHF:BQkPkQ3seajOvsc2C
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
ProductVersion: 1.00
InternalName: pWxaeNOBOK
FileVersion: 1.00
OriginalFilename: pWxaeNOBOK.exe
ProductName: gNvQjyPf

Worm:Win32/Vobfus.DA also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.PonyStealer.MLT.1
FireEyeGeneric.mg.37218cebea471850
CAT-QuickHealTrojan.Vobfus.gen
Qihoo-360HEUR/QVM03.0.0A87.Malware.Gen
ALYacGen:Heur.PonyStealer.MLT.1
CylanceUnsafe
SangforMalware
K7AntiVirusEmailWorm ( 0054d10f1 )
BitDefenderGen:Heur.PonyStealer.MLT.1
K7GWEmailWorm ( 0054d10f1 )
Cybereasonmalicious.bea471
BitDefenderThetaAI:Packer.A23C1C4020
CyrenW32/VBInject.CD.gen!Eldorado
SymantecW32.Changeup
ESET-NOD32a variant of Win32/Pronny.CD
BaiduWin32.Worm.Pronny.d
TrendMicro-HouseCallMal_VBNA-7
AvastWin32:VB-WOU [Trj]
ClamAVWin.Packer.VBCrypt-5731517-0
KasperskyWorm.Win32.Luder.bqja
NANO-AntivirusTrojan.Win32.Vobfus.dxetei
ViRobotTrojan.Win32.A.VBKrypt.135168.DK
APEXMalicious
RisingWorm.Pronny!1.B1A8 (CLASSIC)
Ad-AwareGen:Heur.PonyStealer.MLT.1
SophosML/PE-A + Mal/SillyFDC-T
ComodoWorm.Win32.Pronny.AD@4omzqe
F-SecureTrojan.TR/Dropper.VB.Gen
DrWebTrojan.VbCrypt.60
VIPRETrojan.Win32.Vobfus.gen (v)
TrendMicroMal_VBNA-7
McAfee-GW-EditionBehavesLike.Win32.VBObfus.cm
EmsisoftGen:Heur.PonyStealer.MLT.1 (B)
IkarusWorm.Win32.WBNA
AviraTR/Dropper.VB.Gen
MAXmalware (ai score=87)
Antiy-AVLWorm/Win32.WBNA.gen
MicrosoftWorm:Win32/Vobfus.DA
ArcabitTrojan.PonyStealer.MLT.1
AhnLab-V3Trojan/Win32.VBKrypt.R10485
ZoneAlarmWorm.Win32.Luder.bqja
GDataGen:Heur.PonyStealer.MLT.1
CynetMalicious (score: 100)
TotalDefenseWin32/Vobfus.YQ
McAfeeVBObfus.g
TACHYONTrojan/W32.VB-Agent.135168.AJ
VBA32Trojan.VBRA.023655
MalwarebytesGeneric.Trojan.Malicious.DDS
PandaW32/Vobfus.GEP
YandexTrojan.GenAsa!KgJMo5Dz+vc
SentinelOneStatic AI – Malicious PE – Worm
eGambitUnsafe.AI_Score_99%
FortinetW32/VBObfus.G!tr
AVGWin32:VB-WOU [Trj]
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Worm:Win32/Vobfus.DA?

Worm:Win32/Vobfus.DA removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment