Categories: Malware

W32.Nimnul.F1 removal instruction

The W32.Nimnul.F1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32.Nimnul.F1 virus can do?

Executable code extraction
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Uses Windows utilities for basic functionality
Likely virus infection of existing system binary
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

ddos.dnsnb8.net

a.tomx.xyz

How to determine W32.Nimnul.F1?


File Info:
crc32: 8451151Bmd5: 5771289fcde33c5b163873d9ae9d7b4cname: vsthost_______________.exesha1: 1189e1459843c78a0805a030183f03fbcb965fa7sha256: 763a47de0822bc92b3d1e64e155d7993e777bb7442efdcd405b355a8f5b63ef9sha512: 56b77d1cc67c6608172e889fd296d9216fb8d6afbf930d379be01155a0b4cc42fe12ccc35edf816311a87cd62d6524d4dcca81b7cb0612663e0130e6322ac55assdeep: 24576:QKZIwE1VaJF6oA+AS2027jz1VJS5ZbDscoeGbYn9j:QJx1EJF6oABxHz1VJSbbDscrIYhtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2001-2009 H. SeibInternalName: vsthostFileVersion: 1.47CompanyName: PrivateBuild: LegalTrademarks: ASIO & VST PlugIn Technology by SteinbergComments: ProductName: VSTHost - Simple VST HostSpecialBuild: ProductVersion: 1.47FileDescription: VSTHost - Simple VST HostOriginalFilename: VSTHost.EXETranslation: 0x0409 0x04b0

W32.Nimnul.F1 also known as:

Bkav	W32.FamVT.DumpModuleInfectiousNME.PE
MicroWorld-eScan	Win32.VJadtre.3
FireEye	Generic.mg.5771289fcde33c5b
CAT-QuickHeal	W32.Nimnul.F1
McAfee	W32/Kudj
ALYac	Win32.VJadtre.3
VIPRE	Virus.Win32.Small.acea (v)
K7AntiVirus	Virus ( 0040f7441 )
BitDefender	Win32.VJadtre.3
K7GW	Virus ( 0040f7441 )
Cybereason	malicious.fcde33
TrendMicro	PE_WAPOMI.BM
BitDefenderTheta	AI:FileInfector.991137D00F
F-Prot	W32/PatchLoad.E
Symantec	W32.Wapomi.C!inf
TotalDefense	Win32/Nimnul.A
Baidu	Win32.Virus.Otwycal.d
APEX	Malicious
Avast	Win32:Rootkit-gen [Rtk]
ClamAV	Win.Trojan.Downloader-64720
GData	Win32.Virus.Wapomi.A
Kaspersky	Virus.Win32.Nimnul.f
NANO-Antivirus	Trojan.Win32.Banload.cstqaj
ViRobot	Win32.Ramnit.F
Rising	Virus.Roue!1.9E10 (CLASSIC)
Endgame	malicious (high confidence)
Emsisoft	Win32.VJadtre.3 (B)
Comodo	Virus.Win32.Wali.KA@558nxg
F-Secure	Malware.W32/Jadtre.B
DrWeb	BackDoor.Darkshell.246
Zillya	Virus.Nimnul.Win32.5
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.cc
Trapmine	malicious.moderate.ml.score
Sophos	W32/Nimnul-A
Ikarus	Trojan-Downloader.Win32.Small
Cyren	W32/PatchLoad.E
Jiangmin	Win32/Nimnul.f
Avira	W32/Jadtre.B
MAX	malware (ai score=80)
Antiy-AVL	Virus/Win32.Nimnul.f
Arcabit	Win32.VJadtre.3
ZoneAlarm	Virus.Win32.Nimnul.f
Microsoft	Virus:Win32/Mikcer.B
AhnLab-V3	Win32/VJadtre.Gen
VBA32	Virus.Nimnul.19209
TACHYON	Virus/W32.Ramnit.C
Ad-Aware	Win32.VJadtre.3
Cylance	Unsafe
Panda	W32/Pcarrier.A
Zoner	Virus.Win32.23755
ESET-NOD32	Win32/Wapomi.BA
TrendMicro-HouseCall	PE_WAPOMI.BM
Tencent	Virus.Win32.Loader.aab
SentinelOne	DFI – Suspicious PE
Fortinet	W32/Nimnul.F
AVG	Win32:Rootkit-gen [Rtk]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (D)
Qihoo-360	Virus.Win32.Agent.P