How to remove “Worm:Win32/Rimecud.B”?

The Worm:Win32/Rimecud.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Rimecud.B virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process

How to determine Worm:Win32/Rimecud.B?

File Info:
name: 5CF70B2F283B9E98AD36.mlw
path: /opt/CAPEv2/storage/binaries/1dc5bf2a07bc06ebee299369292dfbd10d58a4fb932b8f170f3239ebce047bd7
crc32: D7B826A0
md5: 5cf70b2f283b9e98ad36888f94b02ba2
sha1: 11646ec2be4b95050385e35f91b3802013aa3079
sha256: 1dc5bf2a07bc06ebee299369292dfbd10d58a4fb932b8f170f3239ebce047bd7
sha512: 4c818940e5a6dc570e9864dd0b4a7eff3e59a959fccb3bc76cd430413e7206248fc1559283a1cb3c74bec81696888fd55a5fef6da22148da90dd5505861e0445
ssdeep: 3072:HWrpaZ4NgwYEQESjjWM267Sep218SFW22dJJrngRJeT:HR+u9PIu7G8S52/xgRE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DC24BF23BEDB9174E204707289E866642B7D9C753C70B90F0393BA6CE0F327556B265B
sha3_384: 1c24712f3a54f18d948136bbaa3bd922781203d259e6792e3908b13cc57c7d35e66d8900a34355dfbbd6348ce14d98d0
ep_bytes: 21f620d221c90f45db21c060558bec33
timestamp: 2009-03-07 08:03:39

Version Info:
CompanyName: c42HhOQ4z
FileDescription: bZo1ePnSB
FileVersion: OBBbOsT.V
InternalName: sTYn7ClYo
LegalCopyright: eHtqEVR4i
OriginalFilename: JFIZ7SlBJ
ProductName: DvVR0j2b9
ProductVersion: SJl0miVc7
Translation: 0x0000 0x0000

Worm:Win32/Rimecud.B also known as:

How to remove Worm:Win32/Rimecud.B?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.