About “Worm:Win32/Vobfus.GD” infection

The Worm:Win32/Vobfus.GD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.GD virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Vobfus.GD?

File Info:
name: 00AB417F5799DF4F153C.mlw
path: /opt/CAPEv2/storage/binaries/8d2f32f07a7433d52e5499672095961e31d9f2bb45b34cbe3297b6e8998827ac
crc32: 0B972AB3
md5: 00ab417f5799df4f153c6a3b58ce3c04
sha1: 978a0fd25fc4c25419af1a80b299d965abc1760e
sha256: 8d2f32f07a7433d52e5499672095961e31d9f2bb45b34cbe3297b6e8998827ac
sha512: 5dbac4943226e819b2ed581b5988ce9e37078e147988093eb810942e0771141fb60345837cd4556c05d13cbba5c8842241115cc0a1a13b33251795256b0b385a
ssdeep: 1536:o6h7KT66jhJg7SbkeYMrvZd48CArrprDlKD:c6SJpkejlfKD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15D93833FBF4854A5F635E27422F2C7E625B6B81C1A0B1A062E047B995EE3E141C5CF93
sha3_384: e145108b35b2dd1875e80131f54088c123746a5bfbe8422589b182fd908bc1ed55d69288207a538a36039e4b5e7dc7a9
ep_bytes: 6858134000e8eeffffff000060000000
timestamp: 2012-07-20 19:24:26

Version Info:
0: [No Data]

Worm:Win32/Vobfus.GD also known as:

How to remove Worm:Win32/Vobfus.GD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.