Worm

About “Worm:Win32/Vobfus.II” infection

Malware Removal

The Worm:Win32/Vobfus.II is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/Vobfus.II virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Behavioural detection: Injection (inter-process)
  • Attempts to disable Windows Auto Updates
  • Anomalous binary characteristics
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Worm:Win32/Vobfus.II?


File Info:

name: 26280667C43992ECB618.mlw
path: /opt/CAPEv2/storage/binaries/513201bf5938f1b0957f9e3aeeaa1a6be288d268d886388bfc5f03fa7b8114ca
crc32: EF0E6108
md5: 26280667c43992ecb618e8eba8401d41
sha1: 90b04a8addcf9dbab9ca3d54a6ce444e2362b3b2
sha256: 513201bf5938f1b0957f9e3aeeaa1a6be288d268d886388bfc5f03fa7b8114ca
sha512: 6897ea299ed2ab51cc7ffabdd4c729fc645601b0c77b31993ceb128f96c1764258dfabcea821bf6d90c8a6d7bd7e03213f527639eeef2236077ce646917e4629
ssdeep: 1536:0FzVpOULMD/2BzqBRpHf8ZyuBs+/PFilZIi6XI:6zVpOrD/2B2d8ZyuRAyX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D2A3B57FB7149059EA15667166F2C7EA026B780C8E0B424667043BAF2DF7F101CACE67
sha3_384: a5a4ac9cd81c1331e99523ff388c131170cf1f4ece5ae28700e0647a0beb14a7a6aa736cef59f2cb32a5834913bf19d8
ep_bytes: 681c134000e8f0ffffff000000000000
timestamp: 2012-09-24 22:52:20

Version Info:

Translation: 0x0409 0x04b0
ProductName: Coutil
FileVersion: 2.03
ProductVersion: 2.03
InternalName: Endoscope
OriginalFilename: Endoscope.exe

Worm:Win32/Vobfus.II also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Barys.950
CAT-QuickHealWorm.VobfusMF.S27266094
SkyhighBehavesLike.Win32.GenDownloader.nt
McAfeeGenDownloader.rv
MalwarebytesGeneric.Malware.AI.DDS
SangforSuspicious.Win32.Save.vb
K7AntiVirusEmailWorm ( 0054d10f1 )
K7GWEmailWorm ( 0054d10f1 )
BaiduWin32.Worm.Pronny.gl
VirITTrojan.Win32.Cryptor.RH
SymantecW32.Changeup!gen20
ESET-NOD32Win32/Pronny.EM
APEXMalicious
TrendMicro-HouseCallWORM_VOBFUS.SM02
ClamAVWin.Trojan.VB-1590
KasperskyWorm.Win32.Vobfus.itw
BitDefenderGen:Variant.Barys.950
NANO-AntivirusTrojan.Win32.Vobfus.cninzp
AvastWin32:VB-AEOF [Trj]
TencentWorm.Win32.Vobfus.q
EmsisoftGen:Variant.Barys.950 (B)
F-SecureTrojan.TR/Downloader.Gen8
DrWebTrojan.MulDrop4.2717
VIPREGen:Variant.Barys.950
TrendMicroWORM_VOBFUS.SM02
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.26280667c43992ec
SophosMal/SillyFDC-Y
IkarusWorm.Win32.Vobfus
JiangminWorm.Vobfus.jdmg
WebrootW32.Worm.Ii
GoogleDetected
AviraTR/Downloader.Gen8
VaristW32/VB.HD.gen!Eldorado
Antiy-AVLWorm/Win32.WBNA.gen
Kingsoftmalware.kb.a.1000
MicrosoftWorm:Win32/Vobfus.II
XcitiumWorm.Win32.Pronny.ABQ@4puwz1
ArcabitTrojan.Barys.950
ViRobotWorm.Win32.A.Vobfus.98304.A
ZoneAlarmWorm.Win32.Vobfus.itw
GDataGen:Variant.Barys.950
CynetMalicious (score: 100)
AhnLab-V3Worm/Win32.Vobfus.R38898
Acronissuspicious
BitDefenderThetaGen:NN.ZevbaF.36802.gm0@aiOmPXpi
ALYacGen:Variant.Barys.950
TACHYONWorm/W32.Vobfus.98304.D
VBA32TScope.Trojan.VB
Cylanceunsafe
PandaTrj/Genetic.gen
RisingTrojan.VB!1.99F7 (CLASSIC)
YandexTrojan.GenAsa!mxtMrV4U5Wc
MAXmalware (ai score=89)
MaxSecureTrojan.Malware.4573848.susgen
FortinetW32/VBObfus.AU!tr
AVGWin32:VB-AEOF [Trj]
DeepInstinctMALICIOUS
alibabacloudTrojan[downloader]:Win/Vobfus.06762d4f

How to remove Worm:Win32/Vobfus.II?

Worm:Win32/Vobfus.II removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment