Win32.Rmnet.14

Win32.Rmnet.14

Added to the Dr.Web virus database: 2012-02-13

Virus description added: 2012-03-05

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'

Creates or modifies the following files:

Malicious functions:

Modifies settings of Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

UDP: