Worm:Win32/Drolnux.A removal

Malware Removal

The Worm:Win32/Drolnux.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Drolnux.A virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Expresses interest in specific running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • A process created a hidden window
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Sniffs keystrokes
  • Checks for the presence of known windows from debuggers and forensic tools
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Detects VirtualBox through the presence of a registry key
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

www.ibayme.eb2a.com

How to determine Worm:Win32/Drolnux.A?


File Info:

crc32: D12F46A3
md5: 06c39f1d810379dfab5df4b7c07f8569
name: 06C39F1D810379DFAB5DF4B7C07F8569.mlw
sha1: 40cc8d978b27a1ad2ba8e125eba3e364ffe959ec
sha256: c14bb39871464f2a956080c36331fae5a1279856ed1ec55fd6cd047d3b209dbb
sha512: 0f9c8349150598ed3d1acbf964b3019b635d713c46b6ec9183fc8e98f7fca5353bf0a3652bce8d458248bf8a813f0c9a5bcaef41dc681ee60d510cca315e522d
ssdeep: 12288:7t8vVED3Bk0Mr9Vif7/F1hIIaYHuvAIS2Z:7t+gvMpVij/F1hV5HuvAIv
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:

ProductVersion: 1.10
InternalName: PDFReader
FileVersion: 1.10
OriginalFilename: PDFReader.exe
ProductName: PDF_Reader_1.1
Translation: 0x0409 0x04b0

Worm:Win32/Drolnux.A also known as:

BkavW32.FamVT.BlockerVM.Trojan
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Generic.8206390
FireEyeGeneric.mg.06c39f1d810379df
McAfeeW32/Worm-FFX!06C39F1D8103
CylanceUnsafe
ZillyaTrojan.Blocker.Win32.1434
AegisLabTrojan.Win32.Blocker.tqB8
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0055e3dd1 )
BitDefenderTrojan.Generic.8206390
K7GWTrojan ( 0055e3dd1 )
CrowdStrikewin/malicious_confidence_100% (D)
BaiduWin32.Worm.Agent.z
CyrenW32/A-0e3801ef!Eldorado
SymantecTrojan Horse
TotalDefenseWin32/Tnega.XEcRLNC
APEXMalicious
ClamAVWin.Trojan.Blocker-391
KasperskyTrojan-Ransom.Win32.Blocker.jgb
AlibabaWorm:Win32/Blocker.7e3ad61d
NANO-AntivirusTrojan.Win32.Blocker.bdcvim
ViRobotTrojan.Win32.A.Blocker.401637
AvastWin32:DelFiles-AE [Trj]
Ad-AwareTrojan.Generic.8206390
EmsisoftTrojan.Generic.8206390 (B)
ComodoTrojWare.Win32.Ransom.Blocker.cdf@4tkf0k
F-SecureWorm.WORM/DelFiles.aouna
DrWebWin32.HLLW.Autoruner1.32327
VIPRETrojan.Win32.Generic!SB.0
TrendMicroWORM_DROLNUX_EI160009.UVPM
McAfee-GW-EditionBehavesLike.Win32.Generic.fh
SophosMal/Generic-S + Troj/Delfiles-V
IkarusWorm.Win32.Delfiles
JiangminTrojan/Blocker.tf
MaxSecureTrojan-Ransom.Win32.Blocker.jgb
AviraWORM/DelFiles.aouna
MAXmalware (ai score=100)
Antiy-AVLTrojan[Ransom]/Win32.Blocker.jgb
KingsoftHeur.SSC.2665991.1216.(kcloud)
MicrosoftWorm:Win32/Drolnux.A
ArcabitTrojan.Generic.D7D3836
SUPERAntiSpywareTrojan.Agent/Gen-Delfiles
ZoneAlarmTrojan-Ransom.Win32.Blocker.jgb
GDataTrojan.Generic.8206390
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Blocker.R46547
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34590.yG3@aixyeCji
ALYacTrojan.Generic.8206390
TACHYONTrojan/W32.Blocker.401805
VBA32BScope.TrojanRansom.Blocker
MalwarebytesDroInux.Worm.Autorun.DDS
ESET-NOD32Win32/Agent.NLV
TrendMicro-HouseCallWORM_DROLNUX_EI160009.UVPM
RisingWorm.Drolnux!1.9CC3 (CLOUD)
YandexTrojan.GenAsa!9kFN0cnOEto
SentinelOneStatic AI – Malicious PE
FortinetW32/Agent.XXI!tr
WebrootW32.Worm.Gen
AVGWin32:DelFiles-AE [Trj]
Cybereasonmalicious.d81037
PandaTrj/Genetic.gen
Qihoo-360Win32/Virus.Drolnux.HwEBdHcA

How to remove Worm:Win32/Drolnux.A?

Worm:Win32/Drolnux.A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment