Trojan

TrojanDownloader:Win32/Renos.OD removal guide

Malware Removal

The TrojanDownloader:Win32/Renos.OD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What TrojanDownloader:Win32/Renos.OD virus can do?

  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Renos.OD?



File Info:

name: ACCD5AFB130D62786C08.mlw
path: /opt/CAPEv2/storage/binaries/3f3074fbac8d181339dbad053bd1ca0f90ec7dc8ddc8bf6c6c6f966e63b483e9
crc32: CF217485
md5: accd5afb130d62786c08eba908610e13
sha1: 6fc30c712cb269e88272104195704cf834ceacee
sha256: 3f3074fbac8d181339dbad053bd1ca0f90ec7dc8ddc8bf6c6c6f966e63b483e9
sha512: f9b7ccc79b2503aa750fc121612345d088d2756cc6c45f7d6a3e7bae56b17164d2967ddda2695b087583cd19072dbb9ac55aa465da62b904ca72323e9f06d26e
ssdeep: 1536:DyvzcUlHSTFpShDz9B04KMMxcydYfzusBXI/rPukl6fVaP5WfuGNweNBPR8iZCSi:2vzcaA7ShoMjAYfznK/brQRNwebmco
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T189A3E0A4B689D804CCDE09B6C47B4FF929563D24DE53910786973E1ABD3F50AAE03A13
sha3_384: 06ff5b9b7e0617a9a61040d5e7fe9c444a96a6467e370471584733756cd4cd9321ab837a5b16601c139d07256b9cab65
ep_bytes: 60be002042008dbe00f0fdff57eb0b90
timestamp: 1992-06-19 22:22:17


Version Info:

CompanyName: .KLite .Codec .Pack
FileDescription: .KLite .Codec .Pack
FileVersion: 9.1.4.1
InternalName: .KLite .Codec .Pack
LegalCopyright: .KLite .Codec .Pack
LegalTrademarks: .KLite .Codec .Pack
OriginalFilename: .KLite .Codec .Pack
ProductName: .KLite .Codec .Pack
ProductVersion: 11.4.2.5
Translation: 0x041b 0x04e2

TrojanDownloader:Win32/Renos.OD also known as:

BkavW32.FakeWmpQKB.Fam.Trojan
LionicVirus.Win32.Krap.lly4
Elasticmalicious (moderate confidence)
MicroWorld-eScanGen:Variant.Renos.48
FireEyeGen:Variant.Renos.48
CAT-QuickHealTrojan.Renos.KF
SkyhighDownloader-CEW.r
ALYacGen:Variant.Renos.48
MalwarebytesCrypt.Trojan.Malicious.DDS
VIPREGen:Variant.Renos.48
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan-Downloader ( 004b8fd51 )
BitDefenderGen:Variant.Renos.48
K7GWTrojan-Downloader ( 004b8fd51 )
CrowdStrikewin/malicious_confidence_100% (W)
VirITTrojan.Win32.Generic.BPEH
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/TrojanDownloader.FakeAlert.BBT
APEXMalicious
ClamAVWin.Trojan.Downloader-16430
KasperskyTrojan-Downloader.Win32.CodecPack.sjt
AlibabaTrojanDownloader:Win32/CodecPack.60f2398f
NANO-AntivirusTrojan.Win32.CodecPack.inlsh
ViRobotTrojan.Win32.Downloader.105984.AC
RisingDownloader.Renos!8.1D0 (TFE:5:3aWgGsxZJoL)
EmsisoftGen:Variant.Renos.48 (B)
F-SecureTrojan-Downloader:W32/Renos.GTB
DrWebTrojan.DownLoad2.19163
ZillyaTrojan.FakeAV.Win32.38015
TrendMicroTROJ_RENOS.SMB
Trapminemalicious.high.ml.score
SophosMal/FakeAV-GX
IkarusTrojan-Downloader.Win32.CodecPack
JiangminTrojanDownloader.CodecPack.emr
GoogleDetected
AviraTR/Agent.103936.22
VaristW32/FakeAlert.JO.gen!Eldorado
Antiy-AVLTrojan[Downloader]/Win32.CodecPack.sjt
KingsoftWin32.HeurC.KVM007.a
MicrosoftTrojanDownloader:Win32/Renos.OD
XcitiumTrojWare.Win32.Kryptik.AAA@2hs9cq
ArcabitTrojan.Renos.48
ZoneAlarmTrojan-Downloader.Win32.CodecPack.sjt
GDataGen:Variant.Renos.48
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.FakeAV.R2261
Acronissuspicious
McAfeeGenericRXAA-FA!ACCD5AFB130D
MAXmalware (ai score=100)
DeepInstinctMALICIOUS
VBA32Malware-Cryptor.Limpopo
Cylanceunsafe
PandaTrj/Renos.gen
TrendMicro-HouseCallTROJ_RENOS.SMB
TencentMalware.Win32.Gencirc.1159d0a4
YandexTrojan.GenAsa!E+VaVMVRSdk
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/CodePack.ABT!tr
BitDefenderThetaGen:NN.ZelphiF.36792.gmKfamocNamc
AVGWin32:Downloader-FCS [Trj]
Cybereasonmalicious.12cb26
AvastWin32:Downloader-FCS [Trj]

How to remove TrojanDownloader:Win32/Renos.OD?

TrojanDownloader:Win32/Renos.OD removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment