Virus:Win32/Ramnit.B information

The Virus:Win32/Ramnit.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Ramnit.B virus can do?

Executable code extraction
Creates RWX memory
Drops a binary and executes it
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
Uses Windows utilities for basic functionality
Tries to suspend Cuckoo threads to prevent logging of malicious activity
Checks for the presence of known windows from debuggers and forensic tools
Tries to unhook or modify Windows functions monitored by Cuckoo
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

zahlung.name

bing.com

yahoo.com

How to determine Virus:Win32/Ramnit.B?


File Info:
crc32: 9D78711F
md5: 4d261fdf15aa586a56fc47e146caa072
name: 216153-karta-vyshek-servera-delirium-gtasa.exe
sha1: 51921988c3923ebe3cdb92b73230457d4ba4b8f1
sha256: e5d793e9b2bb929c593c2180fc07ba626c11513bb713629bcfb83454cc3f3e88
sha512: e7146ee5d47cfc91a628fc95bbb55feb916ed4bd6a330229644fc0cff47e3828227f82c1752f64dc2031a748286612fed46144bb393ded15751caab27198a39e
ssdeep: 393216:PXPSSGIrSnatybzqXRjZENRyZeEmOaYNaFFRa:PpSnatgzexZwypmOaOar4
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
LegalCopyright: www.GameModding.net
InternalName: 
FileVersion: 3.1.0.0
CompanyName: www.GameModding.net
LegalTrademarks: 
Comments: 
ProductName: ModInstall
ProductVersion: 1.0.0.0
FileDescription: ModInstall  3.0 
OriginalFilename: 
Translation: 0x0419 0x04e3

Virus:Win32/Ramnit.B also known as:

Bkav	W32.Trmnet.PE
MicroWorld-eScan	Win32.Ramnit
FireEye	Generic.mg.4d261fdf15aa586a
CAT-QuickHeal	W32.Ramnit.A
McAfee	W32/Ramnit.q
Cylance	Unsafe
VIPRE	Virus.Win32.Ramnit.a (v)
K7AntiVirus	Virus ( 002fe95d1 )
BitDefender	Win32.Ramnit
K7GW	Adware ( 004d85191 )
Cybereason	malicious.f15aa5
TrendMicro	PE_RAMNIT.H
Baidu	Win32.Virus.Nimnul.a
F-Prot	W32/Ramnit.B!Generic
Symantec	W32.Ramnit!inf
TotalDefense	Win32/Ramnit.A
APEX	Malicious
Avast	Win32:RmnDrp
ClamAV	Win.Trojan.Ramnit-1846
GData	Win32.Virus.Nimnul.A
Kaspersky	Virus.Win32.Nimnul.a
NANO-Antivirus	Virus.Win32.Ramnit.eslalb
ViRobot	Win32.Ramnit.E
Rising	Virus.Ramnit!1.9AA5 (CLASSIC)
Endgame	malicious (high confidence)
Sophos	W32/Patched-I
Comodo	Virus.Win32.Ramnit.A@1xq65p
F-Secure	Malware.W32/Ramnit.CD
DrWeb	Win32.HLLW.Tophos.6
Zillya	Virus.Nimnul.Win32.1
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Ramnit.tm
Trapmine	malicious.high.ml.score
Emsisoft	Win32.Ramnit (B)
Ikarus	PUA.GameModding
Cyren	W32/Ramnit.B!Generic
Jiangmin	Win32/Nimnul.a
Webroot	W32.Ramnit
Avira	W32/Ramnit.CD
MAX	malware (ai score=85)
Kingsoft	Win32.Ramnit.la.30720
Arcabit	Win32.Ramnit
ZoneAlarm	Virus.Win32.Nimnul.a
Microsoft	Virus:Win32/Ramnit.B
AhnLab-V3	Win32/Ramnit
Acronis	suspicious
VBA32	Virus.Win32.Nimnul.a
ALYac	Win32.Ramnit
TACHYON	Virus/W32.Ramnit.B
Ad-Aware	Win32.Ramnit
Panda	W32/Cosmu.gen
Zoner	Trojan.Win32.Ramnit.32880
ESET-NOD32	Win32/Ramnit.A
TrendMicro-HouseCall	PE_RAMNIT.H
Tencent	Virus.Win32.Ramnit.c
Yandex	Win32.Ramnit.Gen.3
SentinelOne	DFI – Malicious PE
Fortinet	W32/Ramnit.A
BitDefenderTheta	AI:FileInfector.EAEEA7850C
AVG	Win32:RmnDrp
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Virus.Win32.Ramnit.B

How to remove Virus:Win32/Ramnit.B?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Virus:Win32/Ramnit.B information