Skip to main content
Skip to main content
Microsoft Security Intelligence
500 entries found. Displaying page 1 of 25.
Updated on Apr 11, 2011
Virus:Win32/Ramnit.gen!B is a generic detection for a virus that infects Windows executable files and HTML files, and spreads to removable drives. The virus attempts to open a backdoor and wait for instructions.
Alert level: severe
Updated on Jul 21, 2011

Trojan:Win32/Ramnit.gen!A is a generic detection for a trojan component of the Win32/Ramnit family. The malware uses the infection function of certain variants of Virus:Win32/Ramnit famiy, for example, Virus:Win32/Ramnit.AB.
The trojan spreads by infecting files with certain file extensions. It also injects code into certain processes, and communicates with a remote server to receive certain instructions.
Alert level: severe
Updated on Apr 03, 2014

Virus:Win32/Ramnit.Z is a virus that infects Windows executable (program) files, Microsoft Office files and HTML files. This malware drops and runs other malware, which may be detected as Trojan:Win32/Ramnit.

Virus:Win32/Ramnit.Z is a member of the Win32/Ramnit family.

Alert level: severe
Updated on Sep 14, 2011

Virus:Win32/Ramnit.AE is a detection for files infected by variants of the Win32/Ramnit malware family. This malware drops and loads other malware, which may be detected as Trojan:Win32/Ramnit.D.

Alert level: severe
Updated on Sep 14, 2011

Virus:Win32/Ramnit.AD is a detection for files infected by variants of the Win32/Ramnit malware family. This malware drops and loads other malware, which may be detected as Trojan:Win32/Ramnit.D.

Alert level: severe
Updated on Apr 11, 2011
Virus:Win32/Ramnit.A!dll is a component which is injected into the default web browser process by Worm:Win32/Ramnit.A.
Alert level: severe
Updated on Aug 01, 2011

Virus:Win32/Ramnit.AC is the detection for files infected by variants of the Win32/Ramnit malware family. This malware drops and loads other malware, which may be detected as Trojan:Win32/Ramnit.D.

Alert level: severe
Updated on Apr 11, 2011
Virus:VBS/Ramnit.C is a detection for VBScript appended to HTML or RTF files by Virus:VBS/Ramnit.A!dll. When the infected file is opened, it drops a copy of Worm:Win32/Ramnit.A.
Alert level: severe
Updated on Apr 11, 2011
TrojanDropper:Win32/Stuxnet.A is a trojan that drops and installs other Stuxnet components detected as Trojan:WinNT/Stuxnet.A and Trojan:WinNT/Stuxnet.B. It also injects code into certain processes. The injected code contains links to certain football betting websites.
Alert level: severe
Updated on Sep 21, 2014

Windows Defender Antivirus detects and removes this threat. 

This threat  can infect your files and stop the from working correctly. It can also install other malware, including Virus:Win32/Ramnit.I and Trojan:Win32/Ramnit.A.

See the Win32/Ramnit family description for more information about this family of threats.

Alert level: severe
Updated on Apr 11, 2011
Virus:VBS/Ramnit.D is a detection for a malicious VBScript appended to HTML files by a variant of Virus:Win32/Ramnit. When an infected HTML file is opened, Virus:VBS/Ramnit.D drops and runs a copy of either Trojan:Win32/Ramnit or Trojan:Win32/Ramnit.gen!A.
Alert level: severe
Updated on Feb 08, 2007
Trojan:Win32/Stresid downloads files from remote websites, may install as a browser helper object (BHO), and displays pop-up advertising on affected users’ systems. Some variants of Trojan:Win32/Stresid have been bundled with rootkits that hide its presence on the system. Trojan:Win32/Stresid drops a randomly named executable to the temp directory and a randomly named dll to the Windows directory.
Alert level: severe
Updated on Mar 25, 2007
Trojan:IRC/WinBot opens a backdoor on TCP port 113 and UDP port 30167, connects to an IRC channel, and downloads and installs other files. Trojan:IRC/WinBot also includes keylogger capabilities. Some variants of Trojan:IRC/WinBot include the Win32/Parite virus, possibly as a result of cross-infection. Win32/Parite infects portable executable files on local drives and accessible network shares.
Alert level: severe
Updated on Mar 25, 2007
Trojan:BAT/Zapchast.H opens a backdoor on compromised system, installs the mirc chat client, and uses that client to connect to an IRC server which allows attackers to remotely administer the Trojan.
Alert level: severe
Updated on Sep 05, 2007
TrojanDownloader:Win32/Conhook.A attempts to download content from a remote Web site. TrojanDownloader:Win32/Conhook.A injects its code into running processes which could, depending on configuration, allow the Trojan to bypass permission-based firewalls in order to gain Internet access.
Alert level: severe
Updated on Jun 27, 2007
Trojan:Win32/C2Lop.C is a Trojan that adds Web browser bookmarks, downloads files from remote Web sites, and delivers pop-up and contextual advertisements. Trojan:Win32/C2Lop.C is installed by SoftwareBundler:Win32/MessengerPlus.b!installer.
Alert level: severe
Updated on Dec 17, 2007
Trojan:Win32/Advhost.A is an advertising application downloader.
Alert level: severe
Updated on Apr 11, 2011
Trojan:Win32/Adialer.OP is a Trojan dialer that connects to remote hosts without user consent. The Trojan consists of an installer, and an installed DLL, identified as Trojan:Win32/Adialer.OP!dll. The Trojan may connect to a remote Web site to download data, and may connect to UDP ports 3010 or 3011.
Alert level: severe
Updated on May 17, 2005
Trojan:Win32/Startpage.TE is a destructive Trojan that targets certain versions of Microsoft Windows. The Trojan sets the Internet Explorer default home page to a malicious URL when any user logs on to an infected computer.
Alert level: severe
Updated on Apr 11, 2011
Trojan:Win32/Delf.M!CME-96 is a user-mode rootkit that hides its own presence on the system, as well as hiding the presence of other malicious software to which it may be associated.
Alert level: severe