Worm:Win32/Vobfus.IL removal instruction

The Worm:Win32/Vobfus.IL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Vobfus.IL virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Worm:Win32/Vobfus.IL?

File Info:
name: 21EDD447702994AC3BA2.mlw
path: /opt/CAPEv2/storage/binaries/ba8e1960e75ea91d34416aa65c04c4d020e4aed3a78d7e77e9c8b7d2866d8830
crc32: 2CEB8369
md5: 21edd447702994ac3ba2f4f1d7b0fa76
sha1: c148de5801456ae678b84129eecef86305aaf5f1
sha256: ba8e1960e75ea91d34416aa65c04c4d020e4aed3a78d7e77e9c8b7d2866d8830
sha512: 9e2eb5588d586c4f9a9a874792b741c701808e4d2cf3c5185a83c7fc2167db481af36c7029dfaefaadd4b2c3a311cff0a59f0b36b2ba107e3e082951864080d9
ssdeep: 1536:jfPdiIi+2E6eXTzQ+64OM2OMATZgJ6rMhe6rWhA3KaHmKqi0ZIi6XI:7dr76eXo+TrMhe6rMiNX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FAE3913BBB55185AE61416342AF2C3F61692AC1D8E0B818B6644376F6DF7F080D2DF87
sha3_384: a7fb66c54f0a073e1c6c8ed1fbf3199a78fdf046f4c42247424a704080303bcc414696ccbd1af84f76219609d88505f3
ep_bytes: 68b0134000e8f0ffffff000000000000
timestamp: 2006-02-04 04:24:30

Version Info:
0: [No Data]

Worm:Win32/Vobfus.IL also known as:

How to remove Worm:Win32/Vobfus.IL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.