Microsoft security software detects and removes this threat.

VirTool:INF/Vobfus.gen is a generic detection for autorun.inf files that may be used by variants of the Win32/Vobfus family of worms when spreading to local, network or removable drives.

What to do now

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

Threat behavior

When copying themselves to one of your drives, some variants of the Win32/Vobfus family may create a file named autorun.inf, detected as VirTool:INF/Vobfus.gen, which contains instructions for your computer's operating system. These instructions tell your computer to load the Vobfus worm when you access a drive.

The autorun.inf file will change the default opening behavior of the drive, so that instead of just opening the drive to look at the files inside, you might inadvertently tell the drive to run (much like what happens when you insert a CD into your computer and it automatically starts to install a program).

When the drive runs, it loads the Vobfus worm.

Note: autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation media.

The VirTool:INF/Vobfus.gen detection may be related to Win32/Vobfus. For more information, see the Win32/Vobfus entry.

Analysis by Hyun Choi


There are no common symptoms associated with this threat. Alert notifications from installed antimalware software may be the only symptoms.


Alert level: Severe
First detected by definition: 1.143.2134.0
Latest detected by definition: 1.143.2134.0 and higher
First detected on: Feb 12, 2013
This entry was first published on: Feb 12, 2013
This entry was updated on: Jun 26, 2013

This threat is also detected as:
No known aliases