How to remove “Worm.Win32.Rikihaki.if”?

The Worm.Win32.Rikihaki.if is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.Win32.Rikihaki.if virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Authenticode signature is invalid
Installs itself for autorun at Windows startup

How to determine Worm.Win32.Rikihaki.if?


File Info:
name: 4389B0094D5E8120350B.mlw
path: /opt/CAPEv2/storage/binaries/e6e853d84ae33c17e9175b521dc4a9fca6418e1a34b8e6e224c92a56eb6f8b04
crc32: 4E5ECC7A
md5: 4389b0094d5e8120350b92f1dabeda20
sha1: 6374fc759d6510d7c8160ad9602e9630ff70ada6
sha256: e6e853d84ae33c17e9175b521dc4a9fca6418e1a34b8e6e224c92a56eb6f8b04
sha512: 05e9617d188b393a4cf737724a55ec247a26b6c11569f97b27dcbacca2b1e7af4f17e4600cefc58b6029b7dc24522c4a607ede816c0842fc634c263826eb4225
ssdeep: 6144:SNy6C9ReEWoUC4AbehLQq2UM7Je4kv0HO883Si5/0X:QAehLR2UM7A4S0S3S0/0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T122A48E10F662D035F0A702F68EBA82F4A9347E70077984C777D469AE6B686E4ED35703
sha3_384: 48958e259b27f0e4fe0be2d73925ed3505e1213e646d9a568f2e53e568fd7be30ce0e18aca68bddde8e160c8ddc5316c
ep_bytes: 558bece8d82a0100e8030000005dc3cc
timestamp: 2014-06-16 11:09:27

Version Info:
0: [No Data]

Worm.Win32.Rikihaki.if also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Backdoor.ShadowWali.1
FireEye	Generic.mg.4389b0094d5e8120
CAT-QuickHeal	Worm.Rikihaki.A4
ALYac	Gen:Variant.Backdoor.ShadowWali.1
Cylance	Unsafe
K7AntiVirus	Trojan ( 00023ea01 )
BitDefender	Gen:Variant.Backdoor.ShadowWali.1
K7GW	Trojan ( 00023ea01 )
Cybereason	malicious.94d5e8
Baidu	Win32.Worm.Agent.fw
VirIT	Trojan.Win32.Agent4.BXTR
Cyren	W32/S-4112289e!Eldorado
Symantec	Trojan.Tinba
ESET-NOD32	Win32/Agent.NPZ
APEX	Malicious
Kaspersky	Worm.Win32.Rikihaki.if
NANO-Antivirus	Trojan.Win32.KillFiles.didhhl
Rising	Worm.Rikihaki!1.A2F0 (RDMK:cmRtazqgN4AkVrrx5ubWUT216W87)
Sophos	Mal/Zusy-A
Comodo	Worm.Win32.Rikihaki.A@5sbndo
DrWeb	Trojan.KillFiles.14550
Zillya	Worm.Agent.Win32.28025
TrendMicro	WORM_RIKIHAKI.SM
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.gh
Emsisoft	Gen:Variant.Backdoor.ShadowWali.1 (B)
Ikarus	Worm.Win32.Agent
Avira	HEUR/AGEN.1119489
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Generic.ASMalwS.AAB6CF
Microsoft	Worm:Win32/Rikihaki.A
GData	Gen:Variant.Backdoor.ShadowWali.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R148972
McAfee	W32/Worm-FYO!4389B0094D5E
VBA32	BScope.Trojan.KillFiles
Malwarebytes	Worm.Agent
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	WORM_RIKIHAKI.SM
Yandex	Worm.Agent!cazTjFK00UQ
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.NQD!worm
BitDefenderTheta	AI:Packer.0585414E1F
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Worm.Win32.Rikihaki.if?

Worm.Win32.Rikihaki.if removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X