Worm:Win32/Vobfus.HF removal tips

The Worm:Win32/Vobfus.HF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.HF virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:Win32/Vobfus.HF?

File Info:
name: A7D3B497E00A8A96C224.mlw
path: /opt/CAPEv2/storage/binaries/e501728e802fdab741871aaa28f44b97019f1d7b1cc65756c4217dfc491fe046
crc32: 7D9D800D
md5: a7d3b497e00a8a96c224075c855727d2
sha1: 5ed7f84f3b4099d2500eac20eb9aefaa8e618f99
sha256: e501728e802fdab741871aaa28f44b97019f1d7b1cc65756c4217dfc491fe046
sha512: 7f705c8f9583306a87ec9d6866c334dad3cdd200dbb5532ef117a6259548634f110a63e10b155d9b1a43986aa5f907fe66aed2ce5518921cad5a471a420fbe68
ssdeep: 3072:rreGLIraoEBD6NYhFEr/JVVtOTI4BkcKmPcclV+Q/:nIrabYQ2VVtO7KmkclV+g
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16414F83AFE8293A5D12A5A3639EBC7F506673C0D4F47800BAA1433E91DB1F341D69A47
sha3_384: 51c4aa03dd1617eee27ee30add7fe143c3ba0112a41fd480389ca531b0ee320f83cbaf5c96df45f9426f382eae91dde3
ep_bytes: 6880134000e8eeffffff000000000000
timestamp: 2012-08-14 02:25:37

Version Info:
Translation: 0x0409 0x04b0
Comments: scomunica longeval
CompanyName: scomunica longeval
FileDescription: scomunica longeval
LegalCopyright: scomunica longeval
LegalTrademarks: scomunica longeval
ProductName: scomunica longeval
FileVersion: 8.20
ProductVersion: 8.20
InternalName: Halide
OriginalFilename: Halide.exe

Worm:Win32/Vobfus.HF also known as:

How to remove Worm:Win32/Vobfus.HF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.