Categories: Worm

How to remove “Worm:Win32/Nenebra.A”?

The Worm:Win32/Nenebra.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Nenebra.A virus can do?

Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs
Creates a copy of itself
Anomalous binary characteristics
Attempts to modify Explorer settings to prevent file extensions from being displayed
Attempts to modify Explorer settings to prevent hidden files from being displayed
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Worm:Win32/Nenebra.A?


File Info:
crc32: 262A1615md5: 4281806b55ffc5279b0c20fb6a534197name: original_avatar.scrsha1: 872130598fb08fe013841717bcce723e9d8b55a0sha256: 09edd1870b0cdf11411a62a3f79a313212a525534fb5edf00c364de8e5948901sha512: 8229638ee2395d59d0f8328d1691809d3d927100da8ca69af9b8909ba5b346b0e0bc3e7c3975dccd4e54214320df51ea6a3195bf9e354832a2e06fbfa950e630ssdeep: 3072:6XKtBTMhG/dryHOSIXW9rTsZEV1vyyvBAm0w0MoqT/r+fF6Q4ya++LbAK:6XSBT9VUOqVTaU1qw50ldwQktype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Worm:Win32/Nenebra.A also known as:

MicroWorld-eScan	Win32.Worm.Autorun.VX
CMC	Trojan.Win32.Cosmu!O
CAT-QuickHeal	Worm.Nenebra.AP8
McAfee	Artemis!4281806B55FF
Cylance	Unsafe
VIPRE	Trojan.Win32.Cosmu.xxs (v)
K7AntiVirus	Trojan ( 0016e12c1 )
Alibaba	Worm:Win32/Blocker.c1462679
K7GW	Trojan ( 0016e12c1 )
Cybereason	malicious.b55ffc
Arcabit	Win32.Worm.Autorun.VX
Baidu	Win32.Worm.Delf.ca
Cyren	W32/Cosmu.KVSE-8775
Symantec	W32.SillyFDC
ESET-NOD32	Win32/AutoRun.Delf.HF
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Cosmu-268
Kaspersky	Trojan-Ransom.Win32.Blocker.iwkz
BitDefender	Win32.Worm.Autorun.VX
NANO-Antivirus	Trojan.Win32.Cosmu.bavxrk
ViRobot	Trojan.Win32.A.Cosmu.212480[UPX]
Rising	Malware.FakeFolder@CV!1.6AA9 (CLASSIC)
Endgame	malicious (moderate confidence)
Emsisoft	Win32.Worm.Autorun.VX (B)
Comodo	TrojWare.Win32.Cosmu.KCA@3hhp8i
F-Secure	Worm.WORM/Nenebra.A
DrWeb	Win32.HLLW.Autoruner.57682
Zillya	Worm.Blocker.Win32.1
TrendMicro	Mal_OtorunO
McAfee-GW-Edition	BehavesLike.Win32.Sality.dc
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.4281806b55ffc527
Sophos	W32/AutoRun-BZI
Ikarus	Worm.Win32.Nenebra
F-Prot	W32/Cosmu.C
Jiangmin	Trojan/Cosmu.gje
Webroot	W32.Trojan.Cosmu.Gen
Avira	WORM/Nenebra.A
Fortinet	W32/Cosmu.XXS!tr
Antiy-AVL	Trojan/Win32.Cosmu
Microsoft	Worm:Win32/Nenebra.A
SUPERAntiSpyware	Worm.AutoRun/Variant
ZoneAlarm	Trojan-Ransom.Win32.Blocker.iwkz
AhnLab-V3	Trojan/Win32.Agent.C65479
VBA32	TScope.Trojan.Delf
ALYac	Win32.Worm.Autorun.VX
MAX	malware (ai score=100)
Ad-Aware	Win32.Worm.Autorun.VX
Malwarebytes	Worm.AutoRun
Panda	Generic Malware
Zoner	Trojan.Win32.1947
TrendMicro-HouseCall	Mal_OtorunO
Yandex	Trojan.Cosmu!gKBhUwtv5Oc
SentinelOne	DFI – Suspicious PE
GData	Win32.Worm.Autorun.VX
BitDefenderTheta	AI:Packer.1085453F1D
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Worm.00b