Categories: Trojan

About “Trojan:Win32/Rundis” infection

The Trojan:Win32/Rundis is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Rundis virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Attempts to modify Internet Explorer’s start page
A HTTP/S link was seen in a script or command line
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Disables host Power options (shutdown, logoff, lock, change password)
Attempts to disable or modify the Run command from the Start menu and the New Task (Run) command from Task Manager
Attempts to modify Explorer settings to prevent file extensions from being displayed
Attempts to modify Explorer settings to prevent hidden files from being displayed
Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Rundis?


File Info:
name: D83087EB497E209271FB.mlwpath: /opt/CAPEv2/storage/binaries/3fa9341401a1b8a335160e8270ff51f7f3c25d3df094d0571442fef8b736b45bcrc32: 094412DBmd5: d83087eb497e209271fb4518ae78f567sha1: 667f79f1ff4935146cd338ab6f380fbe7bcb4029sha256: 3fa9341401a1b8a335160e8270ff51f7f3c25d3df094d0571442fef8b736b45bsha512: df24106258524b158702f2f8bbb4251c2894c5133027d91b35873b7419a1696feffc8efa6ff5240c136ee809a22b6ad29a43160f1408ebd3fb99917fca4ad1e2ssdeep: 384:PJG14lR/NpKAN+UJfo8vJh/7neuwyv3ZUKcreuDreuwyv3ZUKcreuDz:RFtFe8vJtDeunUreufeunUreuftype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A755E8537111D830C4947CB861860B395622ECB26951E653F30DFABEBF7B2939B2C19Esha3_384: b0cc584837636ac8795cb75f7c2125a1185b18f8862cd518757edb0aacad7dfec89e462f1265129a1f34dd87b1d9c8efep_bytes: 5589e583ec0883c4f46a02a104524000timestamp: 2004-07-19 06:47:50
Version Info:
0: [No Data]

Trojan:Win32/Rundis also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Generic.Malware.SDy.1E4D16DA
ClamAV	Win.Trojan.Startpage-6162
FireEye	Generic.mg.d83087eb497e2092
ALYac	Dropped:Generic.Malware.SDy.1E4D16DA
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Dropped:Generic.Malware.SDy.1E4D16DA
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 0059acda1 )
K7AntiVirus	Trojan ( 0059acda1 )
VirIT	Trojan.Win32.StartPage.CA
Cyren	W32/Startpage.CDVP-1823
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.MMLETYW
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.StartPage.xu
BitDefender	Dropped:Generic.Malware.SDy.1E4D16DA
NANO-Antivirus	Trojan.Win32.StartPage.crtxme
Avast	Win32:Trojan-gen
Emsisoft	Dropped:Generic.Malware.SDy.1E4D16DA (B)
F-Secure	Heuristic.HEUR/AGEN.1348731
DrWeb	STPAGE.Trojan
Zillya	Trojan.StartPage.Win32.1058
McAfee-GW-Edition	Generic.dc
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Suspicious PE
GData	Dropped:Generic.Malware.SDy.1E4D16DA
Jiangmin	Trojan/StartPage.ihr
Avira	HEUR/AGEN.1348731
Antiy-AVL	Trojan/Win32.StartPage
Arcabit	Generic.Malware.SDy.1E4D16DA
ViRobot	Trojan.Win32.A.StartPage.78848
ZoneAlarm	Trojan.Win32.StartPage.xu
Microsoft	Trojan:Win32/Rundis
Google	Detected
McAfee	Generic.dc
MAX	malware (ai score=84)
VBA32	Trojan.StartPage
Cylance	unsafe
Rising	Trojan.StartPage.bkj (CLASSIC)
Yandex	Trojan.Startpage!wyZqLIoBHSU
Ikarus	Trojan.StartPage
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Generic.AC.29BB34!tr
BitDefenderTheta	AI:Packer.5E1281491D
AVG	Win32:Trojan-gen
Cybereason	malicious.b497e2
DeepInstinct	MALICIOUS