Categories: Worm

Worm:Win32/Narilam.A removal instruction

The Worm:Win32/Narilam.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Narilam.A virus can do?

Creates RWX memory
Unconventionial binary language: Persian (Iran)
Unconventionial language used in binary resources: Farsi
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs
Creates a copy of itself
Anomalous binary characteristics

How to determine Worm:Win32/Narilam.A?


File Info:
crc32: C7A527D9md5: 8e63c306e95843eccab53dad31b3a98bname: data.exe_sha1: b7462e83cd81fcbee7b799e230bed19331c9d516sha256: cf3c015d828784c7dffcba80619dba4cba970680ea5aa9f42f7356e79643a749sha512: ece053e30b211d653a1196db6f11a295d7844cc48bcc9d0dca01f27c3299907a3786a788bfa5366082928120f10e42a358cf7ec7f657f8c366b114f639b70b91ssdeep: 12288:TkK0E0gXYJKubbDpm1NagSX68y5vVrHAnS3DdSERM3BflJ97RlcxOXvxA1F6u:1lUEamagSX6tb93pPRQ79wAfxA1F6utype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: InternalName: lssas.exeFileVersion: 1.0.0.0CompanyName: LegalTrademarks: Microsoft CorporationComments: ProductName: ProductVersion: 1.0.0.0FileDescription: OriginalFilename: lssas.exeTranslation: 0x0429 0x04e8

Worm:Win32/Narilam.A also known as:

DrWeb	Trojan.MulDrop8.28900
MicroWorld-eScan	Gen:Win32.Malware.JH1@amLQt@aG
FireEye	Generic.mg.8e63c306e95843ec
Qihoo-360	Win32/Worm.9cc
McAfee	Generic BackDoor.wc
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Worm.Win32.Narilam.o!c
Sangfor	Malware
K7AntiVirus	Spyware ( 0040aac31 )
BitDefender	Gen:Win32.Malware.JH1@amLQt@aG
K7GW	Spyware ( 0040aac31 )
Cybereason	malicious.6e9584
TrendMicro	Mal_OtorunN
BitDefenderTheta	AI:Packer.8BF8840C1D
F-Prot	W32/Narilam.A
TotalDefense	Win32/FakeFLDR_i
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Narilam-2
GData	Gen:Win32.Malware.JH1@amLQt@aG
Kaspersky	Worm.Win32.Narilam.b
Alibaba	Worm:Win32/Narilam.b1c24e95
NANO-Antivirus	Trojan.Win32.Scar.denje
ViRobot	Trojan.Win32.A.Scar.1569280
Rising	Worm.VobfusEx!1.99DF (KTSE)
Ad-Aware	Gen:Win32.Malware.JH1@amLQt@aG
Sophos	Mal/Banker-CB
Comodo	Worm.Win32.Agent.NGRR@4s93ut
F-Secure	Trojan.TR/Crypt.CFI.Gen
Zillya	Worm.Agent.Win32.2516
McAfee-GW-Edition	Generic BackDoor.wc
Trapmine	suspicious.low.ml.score
CMC	Worm.Win32.Narilam!O
Emsisoft	Gen:Win32.Malware.JH1@amLQt@aG (B)
SentinelOne	DFI – Malicious PE
Cyren	W32/Risk.NLMT-2961
Jiangmin	Trojan/Scar.acbu
Webroot	W32.Narilam
Avira	TR/Crypt.CFI.Gen
Antiy-AVL	Worm/Win32.Narilam
Endgame	malicious (high confidence)
Arcabit	Gen:Win32.Malware.E49811
SUPERAntiSpyware	Trojan.Agent/Gen-Falint
ZoneAlarm	Worm.Win32.Narilam.b
Microsoft	Worm:Win32/Narilam.A
TACHYON	Worm/W32.Narilam.1629184
AhnLab-V3	HEUR/Fakon.mwf.X1381
Acronis	suspicious
VBA32	Trojan.FakeFolder.1941
ALYac	Gen:Win32.Malware.JH1@amLQt@aG
MAX	malware (ai score=100)
Panda	Trj/Scar.AB
Zoner	Trojan.Win32.82569
ESET-NOD32	Win32/Agent.NEN
TrendMicro-HouseCall	Mal_OtorunN
Tencent	Win32.Worm.Narilam.Eddz
Yandex	Worm.Agent!nmyuAQJx1Sc
Ikarus	Trojan-Spy.Win32.Narilam
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Agent.CB!tr
AVG	Win32:Narilam-A [Wrm]
Avast	Win32:Narilam-A [Wrm]
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.5435585.susgen