Win32/Rovnix [Threat Name] go to Threat

Win32/Rovnix.R [Threat Variant Name]

The trojan serves as a backdoor. It can be controlled remotely. The trojan is usually a part of other malware.

The trojan does not create any copies of itself.

The following Registry entry is set:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
- "iexplore.exe" = 11001

The trojan may set the following Registry entries:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
- "Windows" = "%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,1536,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

The trojan launches the following processes:

The trojan creates and runs a new thread with its own code within these running processes.

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (6) URLs. The HTTP protocol is used.

It can execute the following operations:

It can show advertisements.

The trojan sends HTTP requests to simulate clicks on banner advertisements, to inflate web counter statistics etc.

The following programs are terminated:

The trojan hooks the following Windows APIs:

The trojan keeps various information in the following Registry keys:

A string with variable content is used instead of %variable1-2% .