Worm.Win32.Rikihaki.rp removal tips

The Worm.Win32.Rikihaki.rp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Worm.Win32.Rikihaki.rp virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Reads data out of its own binary image
Authenticode signature is invalid
Installs itself for autorun at Windows startup

How to determine Worm.Win32.Rikihaki.rp?


File Info:
name: 9F1D8747576389535D8F.mlw
path: /opt/CAPEv2/storage/binaries/fe7bde8267894726c3a49c78fbc38980fd46087bc133eca646a3f1f86c2b6341
crc32: 85E65024
md5: 9f1d8747576389535d8f579d9baca597
sha1: 389012bed8d8c17a1caac49c618a37b29698a968
sha256: fe7bde8267894726c3a49c78fbc38980fd46087bc133eca646a3f1f86c2b6341
sha512: b782bbbf4b9de5a15af6b178824e11dffd5dde5ddf4b648093b1b834698e448a591ab6bccfd0a7cd5c4e06d2523070b7ca600729f483dccecc96585cf38c1010
ssdeep: 6144:SNy6C9R3LEDAbehLQq2UM7Je4kv0HO883Si5/0f:ihLR2UM7A4S0S3S0/0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11FA47D11F672D035F0A302F68ABA82F4A8347E30177940C777D469AE6B69AE4ED35713
sha3_384: 194e78d3a8d9a02cc6e6e78dbfe4c80f5a48a2801a2c14ee3be3abf0aec9b364815ff348218f4d01a4375d57e31476ea
ep_bytes: 558bece8d82a0100e8030000005dc3cc
timestamp: 2014-06-16 11:09:27

Version Info:
0: [No Data]

Worm.Win32.Rikihaki.rp also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.KillFiles.14550
Cynet	Malicious (score: 100)
FireEye	Generic.mg.9f1d874757638953
CAT-QuickHeal	Worm.Rikihaki.A4
ALYac	Gen:Variant.Backdoor.ShadowWali.1
Cylance	Unsafe
Zillya	Worm.Agent.Win32.28025
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 00023ea01 )
K7AntiVirus	Trojan ( 00023ea01 )
BitDefenderTheta	AI:Packer.0585414E1F
VirIT	Trojan.Win32.Agent4.BXTR
Cyren	W32/S-4112289e!Eldorado
Symantec	Trojan.Tinba
ESET-NOD32	Win32/Agent.NPZ
TrendMicro-HouseCall	WORM_RIKIHAKI.SM
Kaspersky	Worm.Win32.Rikihaki.rp
BitDefender	Gen:Variant.Backdoor.ShadowWali.1
NANO-Antivirus	Trojan.Win32.KillFiles.didhhl
MicroWorld-eScan	Gen:Variant.Backdoor.ShadowWali.1
Avast	Win32:Malware-gen
Emsisoft	Gen:Variant.Backdoor.ShadowWali.1 (B)
Comodo	Worm.Win32.Rikihaki.A@5sbndo
Baidu	Win32.Worm.Agent.fw
TrendMicro	WORM_RIKIHAKI.SM
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.gh
Sophos	ML/PE-A + Mal/Zusy-A
Ikarus	Worm.Win32.Agent
Avira	HEUR/AGEN.1119489
Antiy-AVL	Trojan/Win32.SGeneric
Microsoft	Worm:Win32/Rikihaki.A
ZoneAlarm	Worm.Win32.Rikihaki.rp
GData	Gen:Variant.Backdoor.ShadowWali.1
SentinelOne	Static AI – Malicious PE
AhnLab-V3	Trojan/Win32.Agent.R148972
McAfee	W32/Worm-FYO!9F1D87475763
VBA32	BScope.Trojan.KillFiles
Malwarebytes	Worm.Agent
APEX	Malicious
Rising	Worm.Rikihaki!1.A2F0 (RDMK:cmRtazoGft/pxGxnLZDFNUfRmQen)
Yandex	Worm.Agent!cazTjFK00UQ
MAX	malware (ai score=88)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.NQD!worm
AVG	Win32:Malware-gen
Cybereason	malicious.757638
Panda	Trj/Genetic.gen

How to remove Worm.Win32.Rikihaki.rp?

Worm.Win32.Rikihaki.rp removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X