GridinSoft Threat Intelligence

Worm detection reports

Malware capable of spreading across systems, removable media, or networks.

Detection category

Worm threat reports

Malware capable of spreading across systems, removable media, or networks. ThreatInfo groups these records so analysts and users can review related filenames, hashes, and GridinSoft detection names from one place.

This category page groups related ThreatInfo records so users can compare file names, hashes, publishers, and GridinSoft detection names in one place.

Indexed reports 6,089

Latest shown 60

Detected 60

Observed detection families

Common Worm verdicts

These are the most frequent GridinSoft detection names in the latest reports shown below. Repeated families help users recognize whether a file belongs to a broader campaign or bundled software cluster.

Worm.Ramnit 37 reports

Worm.Autorun 5 reports

Trojan.Agent 3 reports

Worm.Mira 3 reports

Hijack.Explorer 2 reports

Worm.Dorkbot 2 reports

Adware.Downloader 1 reports

General Threat 1 reports

Analyst focus

What to check first

Use this page as a starting point: open the exact file report, compare the MD5 hash, and run a local scan before deciding whether the file is safe.

A known filename appearing with an unexpected hash or location.
Publisher, product, or certificate data that does not match the file origin.
Repeated detections from the same family across recent reports.

Frequent metadata

Publishers and products

Publishers Microsoft Corporation 4 SecuGen 3 Flexera Software, Inc. 2 Igor Pavlov 2 Intel Corporation 2 Microsoft 2

Products Microsoft® Visual Studio .NET 3 Project1 3 7-Zip 2 InstallShield 2 SecuGen Fingerprint Algorithm 2 Age of Empires II Expansion 1

GridinSoft Anti-Malware

Scan for Worm detections

If a file from this category appears on your computer, verify the exact report and run a full system scan. GridinSoft Anti-Malware is used to detect and remove threats listed in ThreatInfo reports.

Download scanner

01 Match the hash

Use the MD5 value from the report. A filename alone is not enough because unrelated files can share the same name.

02 Review origin

Check the publisher, product name, certificate, and file path for mismatches or unfamiliar install locations.

03 Scan and remove

If the file is unexpected, scan the device and remove related startup entries, bundled components, and leftover files.

Recent reports

Latest Worm file records

1c803.exe 60526283d6355858157a73ed4a5eea5e Worm.Autorun LokumGames .scr 06076d35d58368112aca2c2e4bb1f207 Trojan.CoinMiner 104APPLE.exe 483fcf432217d71544246aa760d98cdc Worm.Brontok A0002537.EXE 14638217ef40dc237ffc043e9e70a82c Trojan.Downloader svchost10.exe c78f68988c1dc6f564f5d4a5304f8c06 Adware.Downloader M88_Launcher.exe 6507b5478c511038a317a51f4ad80a32 Worm.Dorkbot WinSeven.exe 5a3400c716a0f35b5a5e01edebba8753 Trojan.Agent e1e1a.exe c2b259aaac60293aec1ed99168f28cf0 Worm.Autorun WinSeven.exe de2b38ed15f4ec56acb3826881b749bd Worm.Autorun Keygen_CaptainSim.exe 31dcc9c6886a52a997bb87b1780a62ff Worm.Dorkbot cmdrv64.sys ab574e37df0da38d782edf7f12ad572a Worm.Boychi ShowFolder.exe1_266122B3B4634A30B650BE8DB4A6EB1A.exe c1c29f13315c6d5e634b7c858006a784 Worm.Mira ShowFolder.exe_98D8D640F31A47008788F9D95A1CB0C3.exe 795a6c5ae1b81cda7896c8b57964405d Worm.Mira dwm22.exe 3ef2c3080678494f4c3fca7df1bcbae4 Trojan.Agent Talismania Deluxe Setup.exe f376e69e40c1f653b3d637e76936fb27 Worm.Zpevdo Generator Visitas.exe 7abe10d5c1294bfafdf269c9ddae4325 Worm.Autorun svchost10.exe 82fc87666a3b47032d4fcb8e2603219c Trojan.Agent NOD32.FiX.v1.9-nsane.exe 1a5e36204f702a11a73a2f4fcb32b319 General Threat explorer.exe ccb7c522cd65ffdb378c49612dbe50a0 Worm.Autorun uninstall.exe 9ce02297043394780cd3c4a309be2faf Worm.Gen svchost10.exe 5442aadc3191893ccf37d4c30bc5c8cf Worm.Mira $RL8WAB3.dll 55c3f6917971b405ec6f86d7b68f10d0 Worm.Ramnit ADBDriverInstaller.exe 23807c22f9b13a66d4bc60e86bf466ed Worm.Ramnit $RIQVRT5.exe 8f7040c2cf29f68f95643e2a71bb6912 Worm.Ramnit closedpw.exe e80c3ae5cfdcd7a4de0aa9bb50a3a6d4 Worm.Ramnit $RQU7PUX.dll 7a524dfdfc558b70affe4ae20fd154b3 Worm.Ramnit $R2OQE8K.dll 3a414e763f1a7ae997ee66fd7cc57f2f Worm.Ramnit 7z.dll d9a9ea10b3c1d39e7af34ab5014a3083 Worm.Ramnit msvcp71.dll 07cdb89f27361d7409f7fb63b4d416f5 Worm.Ramnit swriter.exe bdfc6c054dca5739d4a58347e279d3d1 Hijack.Explorer System.dll f93763025e458bd2ba2cca1bd465ef7f Worm.Ramnit 286A.tmp.exe 8cd333e2c1b0ebbd48272426bc4b9dae Worm.Ramnit nsisXML.dll e157fe4c392776d5174d9dc6363bbb66 Worm.Ramnit UserInfo.dll 10703677f2668c5e893ad12befc9792f Worm.Ramnit setup.exe 1184b0edb52656e42301868053fd5778 Worm.Ramnit sgfplib.dll 170d9a7b3923c2f89f013ba563d09aa4 Worm.Ramnit smath.exe 530ee8aece8cc4a326c63c20a8d5f053 Hijack.Explorer nsisXML.dll 1f61b9a90221c2d856bc828760117247 Worm.Ramnit FindProcDLL.dll bf3c44f15dafdee46f56280998554bd9 Worm.Ramnit UserInfo.dll 5e2c8f656d1e0ca575b76aeb8f4fe168 Worm.Ramnit System.dll 4ab5f9de0042634609e370cd3f6118e8 Worm.Ramnit 228F.tmp.exe 0517c2d7a20fc8e636b998229b159ce7 Worm.Ramnit System.dll 95154016b8702c4e11dad583cfd711f3 Worm.Ramnit atl71.dll aad35fc088229fcf41903b218c7c2b71 Worm.Ramnit sgfpamx.dll de1c2f727e2102d48157b6bf23bc77ff Worm.Ramnit setup.exe a855c6fddc5486d6c9c96440cdaabdea Worm.Ramnit sgfpamx.dll 4a878e33c61f2e110a68c38afab2a7e3 Worm.Ramnit KillProcDLL.dll ab5a4701de09a9a7b83ef03129760c50 Worm.Ramnit msvcr71.dll 80c3428960dcc26fafebd4d0ba848952 Worm.Ramnit KillProcDLL.dll 9a8d5fe7d2e6b11ccb68a532c4238072 Worm.Ramnit 11802843742.exe 1b37b1d3a827efcf45b979bd14251453 Worm.Ramnit nsisXML.dll d92373c62fafcfedf7f6dc0237d812ba Worm.Ramnit zlib1.dll f40bbc323f2c055e98b9868a036f78a4 Worm.Ramnit UserInfo.dll 53a9b7a05f337d585ec115ff769b84ac Worm.Ramnit KillProcDLL.dll 94323e119231f83f1cf1cbf0793f1e75 Worm.Ramnit nsisXML.dll 5fd312c2a56cb02feee80b18c2231a4d Worm.Ramnit 7-zip.dll 9a559b6edd7c8d8d857aeef1f62711c4 Worm.Ramnit System.dll aece3d0b5d278fdf350043b828b9031b Worm.Ramnit 50808386864.exe 9de043108219d2d42d02b15686b360a0 Worm.Ramnit UserInfo.dll 87b996376900ee6e02529aa653bd99f2 Worm.Ramnit

Questions

Worm FAQ

How should I use this category page?

Use it to find recent reports in the same detection family, then open the exact file report and compare the hash, publisher, path, and detection name.

Why can the same filename have different verdicts?

Attackers and bundlers often reuse common filenames, so the MD5 hash and metadata are more reliable than the name alone.

What should I do if a listed file exists on my device?

Do not rely on the filename only. Verify the hash, review the file location, and run a full system scan before keeping or removing it.