Win32/Rovnix

Posted: February 27, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	185

First Seen:	February 28, 2012
Last Seen:	June 13, 2023
OS(es) Affected:	Windows

Win32/Rovnix is a family of boot sector rootkits (AKA bootkits) that consist of multiple components and variants, all of which are dangerous to your computer's security and privacy to a degree that can range from moderately high to immensely so. Updated variants of Win32/Rovnix rootkits can be considered even more difficult to detect than standard rootkits due to their inclusion of unorthodox infection methods and self-preserving anti-security functions. Some components in a Win32/Rovnix infection, such as Win32/Rovnix.B, are used primarily to download, install and run other malicious files, while other members of Win32/Rovnix can contain more specialized functions than the above. In all scenarios, however, Win32/Rovnix will never consist of a single infection and can allow remote criminals to attack your computer from their own server. SpywareRemove.com malware experts recommend that you use only the best anti-malware software available to find and remove Win32/Rovnix, which should be assumed to active until you've taken specific steps to disable Win32/Rovnix and all related PC threats.

The Evolving Nature of Win32/Rovnix Attacks

Unlike the majority of rootkits, even early Win32/Rovnix rootkits such as Win32/Rovnix.A (also known by the aliases BackDoor-CEP and Trojan:Win32/Sisproc eschew usage of Master Boot Record-based attacks which, while effective, are also easily detected by appropriate anti-malware programs. Instead, rootkits from the Win32/Rovnix family use an infection startup method that involves attacks against your computer's NTFS bootstrap code. New variants from Win32/Rovnix (such as Win32/Rovnix.B) have taken this several steps further by adding anti-detection encryption and a basic level of polymorphism, amongst other improvements. At the end of the day, these upgrades all serve to make new versions of Win32/Rovnix rootkits extremely difficult to detect and remove even in cases of normally-qualified anti-malware applications.

Win32/Rovnix rootkits also function in multiple components, and may even be included partially in infections that are linked to other types of PC threats, such as Win32/Carberp-based Trojan droppers. They're capable of attacking both 32-bit and 64-bit versions of Windows, and, after installation, should be assumed to be constantly operational unless you've used specific anti-rootkit measures to disable them. However, like most rootkits, Win32/Rovnix rootkits will not show significant symptoms of their presence, although SpywareRemove.com malware researchers add the caveat that you may notice symptoms from other PC threats that Win32/Rovnix has downloaded onto your PC. Unlike normal programs, Win32/Rovnix even includes its own file system to conceal related files, which can make Win32/Rovnix very close to effectively invisible.

What Win32/Rovnix's New Features Mean for Your Privacy

Although Win32/Rovnix does use innovative features to avoid detection and removal, SpywareRemove.com malware experts have judged Win32/Rovnix's payload to be as standard as they come. Examples of issues that may linger until Win32/Rovnix is completely deleted by appropriate software can include:

Win32/Rovnix can allow criminal access to your PC from a remote C&C server. This server can be used to steal files, download malicious files onto your PC, install unwanted programs or control your computer's actions.
Win32/Rovnix can also harvest personal information, such as account passwords, to send to its aforementioned criminal partners. Win32/Rovnix has been noted to focus on web browsers (such as Internet Explorer and Chrome) for these attacks, but may also steal information from other sources or directly record your keyboard input.
Instructions from its C&C server may reconfigure Win32/Rovnix to make other attacks, such as blocking security programs, redirecting your web browser to hostile sites or installing additional PC threats.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 2.56 KB (2560 bytes)
MD5: 56a43042ab259c5a9782d2b26b79c8f7
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 20, 2012

file.exe

File name: file.exe
Size: 194.04 KB (194048 bytes)
MD5: 4b50035e5a84214a84dcadc61d1e75af
Detection count: 91
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 20, 2012

%APPDATA%\Microsoft\Crypto\RSA\RSA748565165.dll

File name: RSA748565165.dll
Size: 81.4 KB (81408 bytes)
MD5: 85e66af1c36c21d1cec76d8dce28ae7e
Detection count: 91
File type: Dynamic link library
Mime Type: unknown/dll
Path: %APPDATA%\Microsoft\Crypto\RSA
Group: Malware file
Last Updated: January 27, 2016