Home Malware Programs Browser Hijackers Malware.Rujack

Malware.Rujack

Posted: April 6, 2017

Threat Metric

Ranking: 109
Threat Level: 5/10
Infected PCs: 1,009,436
First Seen: April 6, 2017
Last Seen: October 17, 2023
OS(es) Affected: Windows


Rujack is a detection name, which anti-virus product vendors use to describe an annoying piece of software, which purpose is to modify the settings of the Web browsers to refer their users to Mail.ru regularly. While this change is not unsafe, most users are likely to find it quite annoying, especially if they do not speak Russian. The software associated with the Rujack is usually described as a browser hijacker and having one of these programs on your computer is likely to be a rather annoying experience. Browser hijackers may change the default new tab page or homepage of your Web browser to bring traffic to a particular website – in this case, the website is Mail.ru.

Some of the software linked to the Rujack detection are – the 'Rutube Chrome Extension', the 'WebExp Enhanced' extension, and 'UpdHost2' extension. However, it is likely that there are numerous other names being used to disguise the browser hijacking software meant to promote Mail.ru.

The Russian website that Rujack software promotes is safe so that you should not feel threatened. However, this is not a signal that you should not take the required measures to eliminate Rujack and restore your browser's settings. The easiest way to stop the issue is to run a credible PC security scanner since this software is capable of dealing with both high-profile threats and minor annoyances like the Rujack hijacker.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%ALLUSERSPROFILE%\ijhg.vbs File name: ijhg.vbs
Size: 63B (63 bytes)
MD5: f72c0e51ec0d968d482a9a127792aa58
Detection count: 607
Mime Type: unknown/vbs
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: June 20, 2020
%ALLUSERSPROFILE%\ijhg.vbs File name: ijhg.vbs
Size: 60B (60 bytes)
MD5: 990b494c525a8368f4b7ed9bac762ae1
Detection count: 133
Mime Type: unknown/vbs
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: August 20, 2018
%ALLUSERSPROFILE%\ijhg.vbs File name: ijhg.vbs
Size: 63B (63 bytes)
MD5: cbea28fe6583edc76b225b8b928a4d11
Detection count: 101
Mime Type: unknown/vbs
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: February 22, 2022

Registry Modifications

The following newly produced Registry Values are:

CLSID{CBF88FC2-F150-4F29-BC80-CE30EFD1B62C}File name without pathamigo.batЧистилка.lnkRegexp file mask%ALLUSERSPROFILE%\[RANDOM CHARACTERS] [RANDOM CHARACTERS].lnk.bat%ALLUSERSPROFILE%\[RANDOM CHARACTERS] [RANDOM CHARACTERS].lnk.bat%ALLUSERSPROFILE%\Application Data\help.bat%ALLUSERSPROFILE%\help.bat%localappdata%\yandex.bat%PROGRAMFILES%\Subversion\TortoiseSVN Overlay.dll%WINDIR%\System32\Tasks \mysidex[NUMBERS]%WINDIR%\System32\Tasks\101news101net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\101news101org[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\1bl0gcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\1bl0gnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\1news101com[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\1news101net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\24runewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\24runewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\24socialnewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\24socialnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\2infoblogcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\2infoblognet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\3bloginfocom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\7runewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\7runewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\[RANDOM CHARACTERS]journalorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\all-journalnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\andyounnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\bl0gingcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\bl0gingnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\blog9newsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\blogingtcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\blogingtnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\blogmytopnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\bossnewsbiz[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\browser-netnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\browser-netorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\fornews2017net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\fornews2017org[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\fpagesnewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\fpagesnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\free1newsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\gogetnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\good-journalnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\green5news[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\hit5news[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\hitech-2017info[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\hitech-2017net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\hitnews1net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\hitnews1org[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\httphumanvevo12com[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\httpnewsfor24klocom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\httpnewsfor24procom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\httpnewsfor24smocom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\inewsennet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\interesting20news17com[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\interesting20news17net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\internet-lifeorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\inversenewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\jooringcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\jooringnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\journal-allnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\journal-goodnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\journal-goodorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\journalaboutlifeorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\jurnal-lifenet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\kodobi[NUMBERS]%WINDIR%\System32\Tasks\krutonewsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\linenewsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\LookUpPro[NUMBERS]%WINDIR%\System32\Tasks\lorensonewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\lorensonewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\MarketAdvior[NUMBERS]%WINDIR%\System32\Tasks\myblog10com[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\myblognewsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\mynewsforcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\mynewsfornet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\nano-newsinfo[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\new1newsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\new1newsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news-onlyorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news-truenet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news1freecom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news1freeorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news24socialcom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\news24socialnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newscruisenet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newsfor24orgzhrotsm%WINDIR%\System32\Tasks\newshistorysnetlhrots[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newsonlineonlynet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newsonlyonlinenet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newssocialorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newstimes2017[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newstop5net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\newstop5org[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\notbadnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\notbadnewsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\onepagesnewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\onepagesnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\pagesnewsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\timeandnewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\timeandnewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\top5newsorg[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\top9blogcomqazsm%WINDIR%\System32\Tasks\topnews17com[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\topnews17info[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\topnews17net[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\topnewsonlinenet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\vnovostyahnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\yocoursenewscom[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\yocoursenewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\youfreenewsnet[RANDOM CHARACTERS]%WINDIR%\System32\Tasks\YoutubeDownloader%WINDIR%\System32\Tasks\YoutubeDownloader_updHKEY..\..\..\..{RegistryKeys}Software\kodobiSoftware\LookupProSoftware\MarketAdviorSoftware\Microsoft\chstSOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\kodobiSOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\kodobi2SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\LookUpProSOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\LookUpPro2SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\mysidexSOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\mysidex2Software\Microsoft\Windows\CurrentVersion\Run\kodobiSoftware\Microsoft\Windows\CurrentVersion\Run\LookUpProSoftware\Microsoft\Windows\CurrentVersion\Run\MarketAdviorSoftware\Microsoft\Windows\CurrentVersion\Run\mysidexSoftware\mysidexSOFTWARE\Policies\Microsoft\Internet Explorer\SearchScopes\1E35BAB2-2EA9-428D-8E26-705304D76739SOFTWARE\Wow6432Node\Policies\Microsoft\Internet Explorer\SearchScopes\1E35BAB2-2EA9-428D-8E26-705304D76739SOFTWARE\Wow6432Node\ЧистилкаSOFTWARE\ЧистилкаSYSTEM\ControlSet001\services\ChistilkaSYSTEM\ControlSet002\services\ChistilkaSYSTEM\CurrentControlSet\services\ChistilkaHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}kodobiLookupProMarketAdviormysidexЧистилка

Additional Information

The following directories were created:
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Чистилка%ALLUSERSPROFILE%\Чистилка%APPDATA%\CurrencyConvertor%APPDATA%\EVERYDAYHOLIDAY%APPDATA%\MarketAdvior%APPDATA%\Movies%APPDATA%\Onetabber%APPDATA%\PBot%APPDATA%\WeatherForecaster%APPDATA%\YoutubeDownloader%APPDATA%\YoutubeDownloader_upd%APPDATA%\adtschema%APPDATA%\gerpril%APPDATA%\kceidjgdigbhildogdafgekneemgibfe%APPDATA%\msspeedlib%APPDATA%\mysidex%APPDATA%\okagncigkfokplmopeninonbibkmpogi%APPDATA%\printfilterpipelinesvc%AppData%\LookupPro%AppData%\kodobi%TEMP%\tmpnrlv3x9i%TEMP%\tmpq07u1cp9
The following URL's were detected:
//searchtds.ru/gazetwa.ru/kalolo.ruc.traffic-media.co/go.deliverymodo.com/afusagepubgo.comsearch.distring.rusearche-engine.rusearchtrack.rusend-notice.comtop-start-page.com/traff-1.rutraff-2.rutraff-3.rutraff1.rutraff3.rutraffic-media.co/mghtmlvulkanstyle.gq
Loading...