Rustock SpamBOT
Rustock SpamBOT is a trojan that causes the IP address of a computer to be included on the IP blacklist provided on specialized internet resources. This may cause the user to be unable to access certain essential computer system functions, as well as limiting the scope of internet services available.
File System Details
Rustock SpamBOT may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %Program Files%\rhcnotj0e5eg\msvcp71.dll | |
| 2. | %Program Files%\rhcnotj0e5eg\MFC71ENU.dll | |
| 3. | %Program Files%\rhcnotj0e5eg\MFC71.dll | |
| 4. | %Program Files%\rhcnotj0e5eg\msvcr71.dll | |
| 5. | %Program Files%\rhcnotj0e5eg\license.txt | |
| 6. | %Program Files%\rhcnotj0e5eg\database.dat |
Registry Details
Rustock SpamBOT may create the following registry entry or registry entries:
HKLM\Software\Microsoft\38C826F1#38c826f1
HKLM\Software\Microsoft\38C826F1#38c8e294
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier
HKLM\Software\Microsoft\38C826F1
HKLM\Software\Microsoft\38C826F1#38c88b71
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7723c7bb
HKLM\system\controlset001\services\2b963c37
HKLM\Software\Microsoft\38C826F1#Version
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\7723c7bb
HKEY_LOCAL_MACHINE\SOFTWARE\rhcnotj0e5eg
