About “Worm:Win32/Ructo.C” infection

Malware Removal

The Worm:Win32/Ructo.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Ructo.C virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (11 unique times)
  • A process created a hidden window
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

www.youtube.com
www.bing.com
ocsp.pki.goog
i.ytimg.com
fonts.googleapis.com
fonts.gstatic.com
r1—sn-bpb5oxu-3c2r.googlevideo.com
ssl.gstatic.com
g2.symcb.com

How to determine Worm:Win32/Ructo.C?


File Info:

crc32: 1010AB64
md5: 43de7b0f9783f93aaecb557743caa759
name: 43DE7B0F9783F93AAECB557743CAA759.mlw
sha1: 9e4821810c73204ad816936d6ffaf6c6c581e4fe
sha256: bdf8a9dd1f65b90013360105aae783277e478594792886178ccc5c0274f3f677
sha512: 913c0676456a4c2af1eb0078da02e3b18ad7c36d3f70b81d9231a829f6252bdcc98c6aff2e588c0a9764e6365657e7ff29960efa1e413419a89acceb85f44e80
ssdeep: 3072:vc7S3Qx9WusSclTRa9jPanDcsOQRZTW0m4m+SVnQRYbl9:vqS3Quusd5s9janDcs/WZTGu
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0
InternalName: project1
FileVersion: 1.00
CompanyName: Particular
ProductName: cavalo3143
ProductVersion: 1.00
OriginalFilename: project1.exe

Worm:Win32/Ructo.C also known as:

K7AntiVirusTrojan ( 00171bc41 )
LionicTrojan.Win32.Vilsel.4!c
Elasticmalicious (high confidence)
DrWebTrojan.Click.20169
McAfeeGeneric BackDoor.wg
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_80% (D)
AlibabaWorm:Win32/Vilsel.10c86330
K7GWTrojan ( 00171bc41 )
Cybereasonmalicious.f9783f
CyrenW32/SuspPack.G.gen!Eldorado
ESET-NOD32a variant of Win32/VB.NTU
APEXMalicious
AvastWin32:Banker-HEO [Trj]
CynetMalicious (score: 100)
KasperskyTrojan.Win32.Vilsel.atsv
BitDefenderGen:Trojan.Heur.ii0arj5av7piu
NANO-AntivirusTrojan.Win32.Vilsel.uyxey
MicroWorld-eScanGen:Trojan.Heur.ii0arj5av7piu
TencentWin32.Trojan.Vilsel.zsg
Ad-AwareGen:Trojan.Heur.ii0arj5av7piu
SophosMal/Generic-R + Mal/Particula-A
ComodoTrojWare.Win32.PSW.Ldpinch.~NNT@1op6ij
F-SecureTrojan.TR/Crypt.CFI.Gen
BitDefenderThetaAI:Packer.E370FC011D
TrendMicroWORM_RUCTO.SMI
McAfee-GW-EditionBehavesLike.Win32.VirRansom.cc
FireEyeGeneric.mg.43de7b0f9783f93a
EmsisoftGen:Trojan.Heur.ii0arj5av7piu (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Vilsel.swm
Webrootnone
AviraTR/Crypt.CFI.Gen
eGambitGeneric.Malware
KingsoftWin32.Heur.KVM011.a.(kcloud)
MicrosoftWorm:Win32/Ructo.C
ArcabitTrojan.Heur.ii0arj5av7piu
SUPERAntiSpywareWorm.Ructo/Variant
ZoneAlarmTrojan.Win32.Vilsel.atsv
GDataGen:Trojan.Heur.ii0arj5av7piu
AhnLab-V3Trojan/Win32.MSNPass.R1900
Acronissuspicious
VBA32TScope.Malware-Cryptor.SB
MAXmalware (ai score=100)
MalwarebytesMalware.Heuristic.1006
PandaTrj/Genetic.gen
TrendMicro-HouseCallWORM_RUCTO.SMI
YandexTrojan.Vilsel.Gen!Pac.3
IkarusTrojan.Win32.Vilsel
MaxSecureTrojan.Vilsel.agwm
FortinetW32/Vilsel.GA!tr
AVGWin32:Banker-HEO [Trj]
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.Vilsel.HxMBEpsA

How to remove Worm:Win32/Ructo.C?

Worm:Win32/Ructo.C removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment