Home / malwarePDF  

Trojan:W32/Renos.H


First posted on 14 November 2007.
Source: SecurityHome

Aliases :

Trojan:W32/Renos.H is also known as Trojan.Win32.Qhost.TM.

Explanation :

Trojan:W32/Renos.H attempts to lure the computer user into downloading "rogueware" by presenting pop-up windows that warn of a supposed threat.

In addition, Renos.H modifies the computer's hosts-file in such a way that accessing websites of many antivirus vendors is blocked.

When Trojan:W32/Renos.H is run it copies itself to four locations on the hard drive.


It adds the following registry keys so that WinAvXX.exe and printer.exe are automatically run during the system startup.


Programs and shortcuts in the %userprofile%Start MenuProgramsStartup folder are automatically executed on startup. Therefore the other two copies of the trojan are also run every time the infected computer is started; however only one copy will remain running at any time. This makes manual disinfection of the computer more difficult as all four copies of the file must be deleted, if even one remains it will copy itself back into all four locations.

To further hinder it's removal, Renos makes the following changes to Windows Registry:


The above keys disable access to the task manager, registry tools (regedit.exe and regedit32.exe), control panel, and Windows updates.

Winav.exe is added to the list of authorized applications for the Windows XP firewall. Winav.exe is not a part of the trojan, so it is likely part of the software that it wants the computer user to download.

Trojan:W32/Renos.H modifies the system to prevent the infected computer from accessing many websites, most of them antivirus related. This is accomplished by adding the following lines into the hosts file located by default in %windir%system32driversetc under Windows NT/2000/XP/Vista:


Renos.H also changes Internet Explorer's Home page, default search engine, and enables browser extensions and balloon tips. The trojan also changes the Internet security zone settings to enable ActiveX controls.

When the trojan is running it presents the following dialog window every five minutes. The security issue it warns of does not actually exist and is just a hoax to get the user to download rogueware.



See the Rogue Antispyware description for additional details.

Earlier versions of "Renos" were not intrinsically malicious towards the computer's OS, but were fraudulent. Current generations alter the Windows Hosts file and disable Windows Update, classifying them as Malware. See the Renos description for information on earlier versions.

Last update 14 November 2007

 

TOP

Malware :

Family: