Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Rogue:W32/Renos


Aliases:


Rogue:W32/Renos
Trojan.Renos
Trojan-downloader:w32/renos.gen!c

Malware
Rogue
W32

Summary

Dishonest antivirus software which tricks users into buying or installing it, usually by infecting a user's computer, or by pretending the computer is infected.



Disinfection & Removal


Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.For more general information on disinfection, please see Removal Instructions.


Manual Disinfection

I certain circumstances, F-Secure Anti-Virus may not be able to automatically remove files; the user must manually select the correct disinfection action before the antivirus program will proceed.

If a file detected as not-virus:Hoax.Win32.Renos is an executable with a DLL or EXE extension, and is located in Windows, Windows System or in a root folder of C: drive, this file can be safely deleted or renamed.



Technical Details

Rogue:W32/Renos is program that displays annoying fake security warnings. The aim of this software is to trick a computer user to download third-party cleaning utilities, usually anti-spyware scanners.


Installation

The Renos executable file is usually dropped by malicious websites onto the computer system. It may also be delivered in the payload of a trojan.

Typically when a Renos' executable file is run, it drops a DLL file into Windows System folder and registers it as a system component. The DLL is the main Renos component.


Activity

When active, Renos shows a blinking icon in System Tray and periodically (actually quite often to be annoying) shows a fake security warning:

When a user clicks on this alert, his web browser is redirected to a website that offers a cleaning utility (usually anti-adware) for download.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.