Ramnit - what it is, how it spreads, and how to remove it

Ramnit

What it is

Ramnit is a Windows file-infecting worm with trojan capabilities. It can inject itself into EXE and DLL files, add malicious code to HTML pages, and spread via removable drives and network shares. Once established, it deploys backdoors, steals passwords and cookies, and lets attackers control the system for further payloads or data theft. Background and cleanup notes: https://gridinsoft.com/threats/ramnit

Why it matters

A file infector corrupts software across the machine, making recovery harder than removing a single payload. With credential theft and remote control, Ramnit can lead to account takeovers, lateral movement, and reinfection if cleanup is incomplete.

How it works - quick tour

  • Entry: drive-by downloads, trojanized installers, or removable media.

  • Infect: patches local EXE/DLLs and injects code into HTML to spread further.

  • Persist: creates autoruns and contacts command servers for updates.

  • Steal and control: harvests credentials and opens a backdoor for operators.

Red flags

  • Legitimate executables begin triggering AV as infected or unknown.

  • Sudden spikes in detections across many files after a single alert.

  • New autoruns pointing to random-named files in AppData or Temp.

  • Unusual outbound connections from hosts that previously had none.

Prevent it

  • Block untrusted scripts and macros, and disable AutoRun for USB devices.

  • Keep OS and browsers patched, and use reputable anti-malware with web filtering.

  • If detected, isolate the host, reset credentials from a clean device, and restore software from known-good media.

  • Prefer reimage for widespread file infection, then restore documents from clean backups.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Worm

        What it is A worm is malware that spreads by itself over the internet or your Wi-Fi. It doesn’t need you to open a file. It finds weak spots on devices and jumps to them, then keeps spreading. Some worms steal data, some slow your PC, and some bring ...

      • Backdoor

        A backdoor is a hidden way into a device or account. It lets someone bypass normal logins and get in without your knowledge. How it gets there: Malware: a trojan installs secret remote access. Software bugs: attackers exploit a flaw to plant access. ...

      • LokiBot (Loki Password Stealer)

        LokiBot (Loki Password Stealer) What it is LokiBot is a credential-stealing trojan that targets Windows and Android. It grabs passwords, cookies, and wallet data, can take screenshots, and sometimes opens a backdoor for more malware. Technical ...

      • PSW.Stealer (Trojan-PWS)

        What it is A password-stealing trojan for Windows that harvests credentials and other sensitive data, then exfiltrates it to the attacker. See our overview for defenders for details. Why it matters Once stolen, credentials enable account takeovers, ...

      • Internet Worm

        What it is An internet worm is self-spreading malware that copies itself across networks without you clicking or installing anything. Unlike a classic virus that needs an infected file to run, a worm exploits bugs and weak settings to move ...