Worm

Worm:MSIL/Necast.B removal

Malware Removal

The Worm:MSIL/Necast.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:MSIL/Necast.B virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Detected script timer window indicative of sleep style evasion
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Sniffs keystrokes
  • Creates a copy of itself
  • Attempts to disable UAC

How to determine Worm:MSIL/Necast.B?


File Info:

crc32: CCBB8058
md5: bbb3f1debc36c72f8df997b9c34b465e
name: BBB3F1DEBC36C72F8DF997B9C34B465E.mlw
sha1: f566e8fbd1e8257ca02f63de7d305c926197a949
sha256: 08ba540f3c2aba2d4d18d6a19c497aae1466af72d43b0596af63b4f3d4e4de4b
sha512: df5ee35d82dd5f9f1412b5c74a01be410e33f8f8b9a1ba65beedd8819cd626fa3b3745eb9845e46933dd76ad184d73558add33bfae7cafe4be8d9af0e637a1a5
ssdeep: 3072:SQd1hgPxw/xySeilgTi+ujWLw/VDBUtqLdzZYH5xtFTbbv4zve+YRH9ub6hWB:S6KZ8xMilgm+u6LQdOZp+YR91hW
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: n.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:
OriginalFilename: n.exe

Worm:MSIL/Necast.B also known as:

DrWebTrojan.DownLoader6.7537
CynetMalicious (score: 99)
ALYacGen:Variant.MSILKrypt.19
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
Cybereasonmalicious.ebc36c
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Necast.AA
APEXMalicious
AvastMSIL:GenMalicious-EIR [Trj]
ClamAVWin.Trojan.Agent-451137
KasperskyTrojan-Ransom.Win32.Blocker.hegq
BitDefenderGen:Variant.MSILKrypt.19
NANO-AntivirusTrojan.Win32.IrcBot.dkgdqw
MicroWorld-eScanGen:Variant.MSILKrypt.19
TencentMsil.Backdoor.Ircbot.Pitn
Ad-AwareGen:Variant.MSILKrypt.19
SophosML/PE-A + Mal/MsilPKill-C
ComodoMalware@#m3fne2x4q13n
BitDefenderThetaAI:Packer.60A526B01F
VIPRETrojan.Win32.Generic.pak!cobra
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
FireEyeGeneric.mg.bbb3f1debc36c72f
EmsisoftGen:Variant.MSILKrypt.19 (B)
SentinelOneStatic AI – Malicious PE
JiangminBackdoor/MSIL.qr
AviraTR/Dropper.Gen
eGambitUnsafe.AI_Score_100%
KingsoftHeur.SSC.2760203.1216.(kcloud)
MicrosoftWorm:MSIL/Necast.B
ArcabitTrojan.MSILKrypt.19
AegisLabTrojan.Win32.Generic.lsjW
ZoneAlarmTrojan-Ransom.Win32.Blocker.hegq
GDataGen:Variant.MSILKrypt.19
AhnLab-V3Backdoor/Win32.IRCBot.R31260
McAfeeArtemis!BBB3F1DEBC36
MAXmalware (ai score=81)
VBA32Backdoor.MSIL.IrcBot
PandaTrj/CI.A
RisingRansom.Blocker!8.12A (CLOUD)
IkarusWorm.Win32.Msil
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/IRCBot.BA!tr.bdr
AVGMSIL:GenMalicious-EIR [Trj]
Qihoo-360Win32/Ransom.Blocker.HwMAjR8A

How to remove Worm:MSIL/Necast.B?

Worm:MSIL/Necast.B removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment