PWS:Win32/Lmir.BMR removal guide

The PWS:Win32/Lmir.BMR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Lmir.BMR virus can do?

Executable code extraction
Creates RWX memory
Expresses interest in specific running processes
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Checks for the presence of known windows from debuggers and forensic tools
The following process appear to have been packed with Themida: D3B2A7E6834C4BA608CF1C8F1AA6BE17.mlw
Checks for the presence of known devices from debuggers and forensic tools
Detects the presence of Wine emulator via registry key
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine PWS:Win32/Lmir.BMR?


File Info:
crc32: ED8FBF6A
md5: d3b2a7e6834c4ba608cf1c8f1aa6be17
name: D3B2A7E6834C4BA608CF1C8F1AA6BE17.mlw
sha1: befc91ddd81c74af34c1170cc90ac7cee806f7ad
sha256: 90817b9ce3bce7695572bc4e7c5107704e5c13efffb156e086c4f360d80d0a77
sha512: c16214195df19e137d0907aac3696761333dc2bf3e36ce530c79100032ca19924609e42de498c49a7ef513f71bccc972cb9d6bb31c82e2de39b851651d4c8d33
ssdeep: 49152:s3kz5HmljUtJeYGpQjcn2hWp4crtNXg1:FqjUneYqf3g
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

PWS:Win32/Lmir.BMR also known as:

Bkav	W32.AIDetect.malware2
Cynet	Malicious (score: 100)
ALYac	Trojan.Generic.7903442
Cylance	Unsafe
Sangfor	Infostealer.Win32.Lmir.BMR
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Packed:Win32/Themida.686d8af7
Cybereason	malicious.6834c4
ESET-NOD32	a variant of Win32/Packed.Themida.BH suspicious
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Generic.7903442
NANO-Antivirus	Trojan.Win32.Lmir.ehpaut
MicroWorld-eScan	Trojan.Generic.7903442
Ad-Aware	Trojan.Generic.7903442
Comodo	Malware@#ts1mdt8pv1qu
BitDefenderTheta	Gen:NN.ZexaF.34608.Jz0aaWGXaroP
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Trojan.tc
FireEye	Generic.mg.d3b2a7e6834c4ba6
Emsisoft	Trojan.Generic.7903442 (B)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_100%
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Microsoft	PWS:Win32/Lmir.BMR
Gridinsoft	Trojan.Heur!.038100A1
Arcabit	Trojan.Generic.D7898D2
GData	Trojan.Generic.7903442
McAfee	Artemis!D3B2A7E6834C
MAX	malware (ai score=87)
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Malware.Heuristic.1003
Rising	Malware.Heuristic!ET#86% (CLOUD)
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove PWS:Win32/Lmir.BMR?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

PWS:Win32/Lmir.BMR removal guide