General explanation
Type: Virus
Degree of destruction: High
Prevalence: high
Names of the malware:
- Virus.Win32.Nimnul.a (Padvish)
- Virus.Win32.Ramnit.a ( Padvish)
- Dropper.Win32.VBS.ramnit (Padvish)
- Virus:Win32/Ramnit.I (Microsoft)
- Virus.Win32.Nimnul.a (Kaspersky)
- Win32.Ramnit.N (BitDefender)
- Win32/Ramnit.H (Eset)
- W32/Ramnit.C (Avira)
What is the Virus?
Computer viruses such as Nimnul are types of malware that cannot reproduce. Viruses can infect all accessible execution files of the system that contains .exe and .dll extensions. Viruses are looking for not infected files of any system (host), and for their reproduction, they need the host’s files to place their codes among the codes of the host’s file. Then, every time the infected file runs, also the malicious code will be simultaneously run.
What is Nimnul malware?
It is a virus that simultaneously will infect system files and downloads and place other malware on the system. In fact, it also acts as a Dropper. Also, it permits unauthorized access to the infected system, and then it can access the following list of actions:
- Download and execute desired files
- Uploading the files of the victim’s system
- Executing keylogger and stealing critical information
- Changing the system settings
- Executing and completing some processes
- Removing files
Technical explanation
Signs of infection
- Changing the nature of system execution files
- Changing the nature of the system HTML files (adding scripts to HTML files)
- Infecting portable drives
Infected operations of this malware:
- It will create a sample, that contains its own name by adding “srv” and “mrg” phrases to the name when it runs on the system.
- It will infect all execution and HTML files on the Hard Drive and portable drives.
- Creating a backdoor for the attacker
- Injecting itself into the installed processes on the system.
How to deal with it and disinfect the system
If your system is infected by the Nimnul malware, act as follows:
- Install Padvish on your system
- Connect the portable drive to your system
- Scan the portable drive by Padvish to disinfect the portable drive and your system
- Note: Choose disinfection on the next boot to have complete disinfection if it was unsuccessful.
- Additionally, Padvish, by UMP capability, will protect your system from infection by portable drives.