Categories: Malware

BAT/KillWin.NAR removal instruction

The BAT/KillWin.NAR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/KillWin.NAR virus can do?

Uses Windows utilities for basic functionality
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Exhibits possible ransomware file modification behavior
Network activity detected but not expressed in API logs
Clears Windows events or logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine BAT/KillWin.NAR?


File Info:
crc32: 9486161Dmd5: 980d12aaf64936587e359b7dce0e588aname: 980D12AAF64936587E359B7DCE0E588A.mlwsha1: ec5227f283dfec5fbf76af85184013926274ae37sha256: 57d514f2de4d9aaf8a3b1f7af047c15025c5a05db265d9c20586ad8d143d8180sha512: f8a27f31a467d46c862c9b08597ae08507fe1908f2419ef13da4ac830b2d8c668cd5d354a50f3e8f970e4575bf945e6425d5c7d57074bf1cf5e0d246cd1eb93cssdeep: 1536:YI7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfAwhicOa:YGFfHgTWmCRkGbKGLeNTBfAIDtype: PE32 executable (console) Intel 80386, for MS Windows
Version Info:
0: [No Data]

BAT/KillWin.NAR also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.GenericPMF.S15065801
ALYac	Dropped:Trojan.BAT.Delete.DA
Cylance	Unsafe
K7GW	Trojan ( 0052419b1 )
K7AntiVirus	Trojan ( 0052419b1 )
Cyren	W32/SchoolBoy.B.gen!Eldorado
ESET-NOD32	BAT/KillWin.NAR
Avast	BV:Deleter-DP [Trj]
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-Dropper.Win32.Scrop.gen
BitDefender	Dropped:Trojan.BAT.Delete.DA
MicroWorld-eScan	Dropped:Trojan.BAT.Delete.DA
Ad-Aware	Dropped:Trojan.BAT.Delete.DA
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.nh
FireEye	Generic.mg.980d12aaf6493658
Emsisoft	Dropped:Trojan.BAT.Delete.DA (B)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_88%
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	Trojan.BAT.Delete.DA
GData	Dropped:Trojan.BAT.Delete.DA
TACHYON	Ransom/W32.FileCoder.92672
Acronis	suspicious
MAX	malware (ai score=81)
Rising	Trojan.Generic@ML.100 (RDMK:5KHExr5KNdFBQS6rBD9uzg)
MaxSecure	Trojan.Malware.73742979.susgen
AVG	BV:Deleter-DP [Trj]