What is "Win32/Ramnit.CZ"?

The Win32/Ramnit.CZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Ramnit.CZ virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Collects information about installed applications
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Ramnit.CZ?


File Info:
crc32: FB86C427
md5: 682647a7b25831514bf7b42b679aead7
name: 682647A7B25831514BF7B42B679AEAD7.mlw
sha1: ef204aa9f7a7e28ab5380e0916ff53075e1afe5b
sha256: 36533f221ce17eb9dedcbd057676afc2fba0beba2331318d21be56e80051e2a1
sha512: 85a69c237186a149f63a3518c4a2fdf1d4674dd447cd31523edcacc0db0e8da1234a74fcd8e9963566a5d2e77cd33356fa2c20bc35c8cbb7d8286259e9112941
ssdeep: 24576:3dKD8E2AcI+mpLHFSLCfgTPH1EaxlEyR1WxclVq8mZaji+4H8bDvU4sOkf0pqsBI:NKD8ECUgNlE4AT8m5fgDvU4hkfiCx
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright 2015 Netflix 
InternalName: Overused
FileVersion: 8.5.90.3
CompanyName: Netflix 
PrivateBuild: 8.5.90.3
Comments: Clb Meters Prime Iwrk Host        gateway
ProductName: Overused
ProductVersion: 8.5.90.3
FileDescription: Clb Meters Prime Iwrk Host gateway
OriginalFilename: Overused
Translation: 0x0409 0x04b0

Win32/Ramnit.CZ also known as:

K7AntiVirus	Trojan ( 0056e9b31 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.Autoruns.GenericKDS.31259782
Cylance	Unsafe
Zillya	Trojan.Yakes.Win32.69704
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Yakes.0801fac8
K7GW	Trojan ( 0056e9b31 )
Cybereason	malicious.7b2583
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Ramnit.CZ
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan.Win32.Yakes.xnwl
BitDefender	Trojan.Autoruns.GenericKDS.31259782
NANO-Antivirus	Trojan.Win32.Yakes.fitssf
MicroWorld-eScan	Trojan.Autoruns.GenericKDS.31259782
Tencent	Win32.Virus.Ramnit.Wnmk
Ad-Aware	Trojan.Autoruns.GenericKDS.31259782
Sophos	Mal/Generic-S
Comodo	Malware@#2wwwziazd5rdx
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
FireEye	Generic.mg.682647a7b2583151
Emsisoft	Trojan.Autoruns.GenericKDS.31259782 (B)
Jiangmin	Trojan.Yakes.abgr
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1130350
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Glupteba!ml
ZoneAlarm	Trojan.Win32.Yakes.xnwl
GData	Trojan.Autoruns.GenericKDS.31259782
McAfee	Artemis!682647A7B258
VBA32	Trojan.Yakes
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/CI.A
Rising	Trojan.Generic@ML.83 (RDML:MrFP+KfvJvRC5UQXsSAC2A)
Ikarus	Trojan-Ransom.GandCrab
AVG	FileRepMalware
Paloalto	generic.ml

How to remove Win32/Ramnit.CZ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Win32/Ramnit.CZ”?