What is “Worm:Win32/Vobfus.HH”?

The Worm:Win32/Vobfus.HH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.HH virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded pe malware family
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Worm:Win32/Vobfus.HH?

File Info:
name: 854A15F8CD0A914E2A9C.mlw
path: /opt/CAPEv2/storage/binaries/a4fb88a7c5806641be76c9f9740aabebee37896b1bba6743e38ecd90234707a8
crc32: 26F21F5E
md5: 854a15f8cd0a914e2a9c4017d7d21987
sha1: 2068978c7451d8a3d88f97eabf2ec87d2dd7e63a
sha256: a4fb88a7c5806641be76c9f9740aabebee37896b1bba6743e38ecd90234707a8
sha512: 28581032366caf9061c4e8ba017fc40f3bfc264c7e9211e5d24be77b7cb8e2830d34203e579738e0da38ad7e54dc3f1bba85985b9465e62ce68d6fbc9560c9fd
ssdeep: 1536:Po9LxOf4BlqPAKixnX+PBcRlouQvSPouXZ6D6Jj5wl+dwCMZUbP7X2YhxYAZxZCq:gPKalqPpU+Pco6ouZ68Kl+dnMZUbxd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T145E30B2BBBA69056E67916302AF3C7F196B7BC3B5B0B411F674432291CB1F140C68B67
sha3_384: f2731cdec09407209ff15e0ca195e6d691d247da84a2f024b26fc668a546e9ad6a36f6c5e898feb7af8ec729dacc5af7
ep_bytes: 68e8124000e8eeffffff000000000000
timestamp: 2012-08-30 02:37:00

Version Info:
Translation: 0x0409 0x04b0
Comments: acquietava ninnyism
CompanyName: acquietava ninnyism
FileDescription: acquietava ninnyism
LegalCopyright: acquietava ninnyism
LegalTrademarks: acquietava ninnyism
ProductName: acquietava ninnyism
FileVersion: 0.79
ProductVersion: 0.79
InternalName: Undonated
OriginalFilename: Undonated.exe

Worm:Win32/Vobfus.HH also known as:

How to remove Worm:Win32/Vobfus.HH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.