The file RUNR.EXE is identified as a virus dropper.
The dropper RUNR.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file RUNR.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the RUNR.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the RUNR.EXE process and delete the file RUNR.EXE.
Malware Analysis of RUNR.EXE
Full path on a computer: %SysDir%\runr.exe
Detected by UnHackMe:
RUNR.EXE
Default location: %SysDir%\runr.exe
Removal Results: Success
Number of reboot: 1
RUNR.EXE is known as:
Trojan.Runr, Trojan.Jorik.Yoddos.ro, Trojan.Yoddos.vZRMA1N+NxE, Trojan.Jorik.xsypy, Trojan.Farfli (A), TrojWare.FakeAV.HH, Trojan.DownLoader6.46754, TR.Drop.Agent.16896.2, Troj.EncodeIe.ao.(kcloud), Backdoor.Zegost.AK, Trojan.Agent.Gen-Zegost, Trojan.Agent, a variant of Win32.Farfli.OP, Backdoor.Farfli.493C, W32.Yoddos.OP.tr
RUNR.EXE hash:
- MD5: 37947ab46e2029b8a5e0e654d8e676c5
Registry:- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\zxcd: 63 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 72 75 6E 72 2E 65 78 65 00 00 00 00 7A 78 63 64 00 00 00 00 52 65 67 44 65 6C 65 74 65 56
Files:- %SysDir%\runr.exe