Hoax.Renos
Hoax.Renos Description
Hoax.Renos is a trojan employed by many rogue anti-spyware applications in order to persuade the user to purchase those applications. This is usually done by generating fake security alerts and notifying the user of non-existent threats. Hoax.Renos usually uses ActiveX controls and various browser security holes in order to infect potential victim machines. This trojan is known to be very difficult to remove.
Type: Trojans
How Can You Detect Hoax.Renos?
Hoax.Renos Technical Report
As new Hoax.Renos details are reported by our customers and findings from our Threat Research Center, we will update this section.
The following Hoax.Renos files with its MD5s were created in the system:
| File Name | File Size | MD5 |
|---|
| aakaafjy.dll | 131072 | 5d2e7706260e6b3b7c3ae3e6dc6b369e |
| akhwjhpi.exe | 77824 | 8d2d474f887e617238ab0ef30f7d0743 |
| akjsfmea.dll | 73728 | 1a580f5d4369277c1db23a9d52c4e3cb |
| autorun.exe | 12288 | 8c194d5a3a785c6a1e1d3d810e2a3d1b |
| axuilelx.exe | 77824 | f99db1c2b5126d347066cf5ba1d9bfff |
| kxfcedlq.dll | 86016 | 3b6330ba64de6dcab23e1cf936f0222f |
| anr10041.exe | 16896 | fd36b4139f13e6cc5c8e81b6b4df8ff3 |
| Tempwn10041.exe | 16896 | fd36b4139f13e6cc5c8e81b6b4df8ff3 |
| us10041[1].exe | 16896 | fd36b4139f13e6cc5c8e81b6b4df8ff3 |
| autorun.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| Templx10041.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| vs10041[1].exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| findfast.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| shell.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| printer.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| spoolvs.exe | 10240 | a4e7ff8876b6d5dea5f9c5576d857354 |
| spoolvs.exe | 9728 | 70bec45867c8c26154aab921d40fd112 |
| autorun.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| Templx10049.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| vs10049[1].exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| findfast.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| shell.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| printer.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| spoolvs.exe | 9728 | 84e8d514487562dcc6b36a8e551b2d19 |
| printer.exe | 9728 | 9c27e97beb9471986cdac0588d64e03a |
| rtmipr.dll | 13312 | 5590b0d943592f7046664f86cbbbe369 |
| tempo-139421.tmp | 118276 | 46cd680d6d08b4369164fcd6ff1ab20d |
Hoax.Renos has typically the following processes in memory:
- printer.exe
- spoolvs.exe
Hoax.Renos creates the following registry entries:
- e89fa8e9-5c0b-45f6-a70e-f7b177bcd193
- Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\e89fa8e9-5c0b-45f6-a70e-f7b177bcd193
Important Article Disclaimer

English 
Deutsch
Español
Français
Portuguese
Hoax.Renos 










