Prevx Research Division
RVHOST.EXE
System Back DoorFree PC Cleanup from Webroot
Use Webroot SecureAnywhere to remove RVHOST.EXE.
"Just when you thought it couldn't get any better or faster. The Webroot scanning engine is 'high octane' with a hidden nitrous oxide system. Bravo!!!" W. Lodzinski, SecureAnywhere User
Associated Malware Groups
The filename is associated with the malware groups:
- System Back Door
- Cloaked Malware
- Worm
File Behavior
RVHOST.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- Copies files
- Executes a Process
- Injects code into other processes
- This Process looks to see what security products and services are running on the system
- Sets processes to start during user logon
- Disables safe mode on your PC
- Creates a new Background Service on the machine
- Drops known malicious software during execution
- Disables or impairs the normal operation of the Windows Security Center
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Disables Access to the Windows Registry Editior
- Disables Access to the Task Manager built into Windows
- Disables the built in Windows File Protection System
- Modifies Windows Security Policies to restrict/expand User Privileges on the machine
- Writes to another Process's Virtual Memory (Process Hijacking)
- Registers a Dynamic Link Library File
- Can communicate with other computer systems using HTTP protocols
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
- Creates, modifies or schedules batch jobs
- Makes outbound connections to other computers using NETBIOSOUT protocols
- Hooks the WININET.DLL function allowing it to read or copy Http and Https web page content and session information
- Injects code into other processes
- Performs DNS look ups to resolve URL IP addresses
- Creates or uses a background service to access the Internet using HTTP protocols
RVHOST.EXE has been the subject of the following behavior:
- Added as a Registry auto start to load Program on Boot up
- Copied to multiple locations on the system
- Executed as a Process
- Created as a new Background Service on the machine
- Has code inserted into its Virtual Memory space by other programs
- Created as a process on disk
- Terminated as a Process
- Deleted as a process from disk
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename RVHOST.EXE was first seen on May 8 2007 in the following geographical regions of the Webroot community:
- on May 8 2007
- Saudi Arabia on May 8 2007
- Vietnam on May 22 2007
- Malaysia on Jun 5 2007
- Hong Kong on Aug 31 2008
- Spain on Aug 23 2009
- Turkey on Jan 9 2010
- The United Kingdom on Jan 9 2010
File Name Aliases
RVHOST.EXE can also use the following file names:
- LANGUAGEMODULES.EXE
- PICTURE.EXE
- AUTO VL PRO HERO & NM.EXE
- TINHLAGI 1.94.EXE
- TU CHOI - TU SAT.EXE
- VL AUTO PRO 2.37.EXE
- VL PRO CRACK.EXE
- MIOZIK TRANIM.EXE
- KHLENE A3SHLAK - HYDI MONTASER.EXE
- BARK BLADI.EXE
- FOA3D&MOHIE.EXE
- NEW KAZEM111.EXE
- NOK CUCI.EXE
- SAMPLE MUSIC.EXE
- KEYGEN.EXE
- SOLSUITE.EXE
- READER.EXE
- FONTS.EXE
- ROSE REMOVAL.EXE
- REMOVE IT.EXE
- KASPERSKY6.KEYS.EXE
- REAL_SC.EXE
- FDL SHAKR 2009.EXE
- JASON.EXE
- YAğMURUN şARKıLAR.EXE
- GAMES.EXE
- BBU934PV.EXE
- OFFLINE.EXE
- DRIVERS.EXE
- ADMINISTRATEUR.EXE
- APPLICATION DATA.EXE
- FICHIERS COMMUNS.EXE
- CONTENT.MSO.EXE
- OIS.EXE
- OLK44.EXE
- PROGRAM FILES.EXE
- DéMARRAGE.EXE
- BUREAU.EXE
- SYSTEM32.EXE
- WINDOWS.EXE
- TEMPORARY INTERNET FILES.EXE
- A47GGKMS.EXE
- TEMP.EXE
- WBEM.EXE
- .EXE
- .EXE
- AHDV_VIRUS.EXE
- .EXE
- MY MUSIC.EXE
- MUSIC.EXE
- IMAGES[n].EXE
- ARDV_SUSPICIOUS_FILE(S).EXE
- SCROPIONS.EXE
- HEAVY HARD HOT.EXE
- X - JAPAN.EXE
- MAROON 5.EXE
- COFEE PRINCE.EXE
- .EXE
- .EXE
- SYSTEM.EXE
- DRIVEGUARD.EXE
- 1.EXE
- .EXE
- .EXE
- .EXE
- .EXE
- .EXE
- PRESENT.EXE
- .EXE
- .EXE
- .EXE
- TEXT.EXE
- 2.EXE
- 23_OPF_FILES.EXE
- .EXE
- .EXE
- OKOKOKL.EXE
- .EXE
- NEW2.EXE
- MUSICOK.EXE
- GOONG.EXE
- SECURITY.EXE
- .EXE
- AON[n].EXE
- .EXE
- [n].EXE
- WEB.EXE
- IMAGE.EXE
- IMAGE[n].EXE
- WEB[n].EXE
- UNTITLED.EXE
- UNTITLED[n].EXE
- [n].EXE
- ()[n].EXE
- .EXE
- [n].EXE
- SECURITY[n].EXE
- SYSTEM[n].EXE
- MISC.EXE
- MISC[n].EXE
- RECYCLER.EXE
- COREL.EXE
- STARTUP.EXE
- EPIC.EXE
- NEW FOLDER.EXE
- SOUNDS.EXE
- DCIM.EXE
- BJPRINTER.EXE
- CANON I865.EXE
- NAJIM ZARHOUNI.EXE
- BOYS TRIP 29 APRIL 2007.EXE
- فلاش.EXE
- BIN.EXE
- CONF.EXE
- DRACULAVIRUSTEMIZLEYICIV3.0.EXE
- şARKıLAR.EXE
- GTA-YENI.EXE
- ISMAIL YK.EXE
- MüZIK.EXE
- MAM.EXE
- .EXE
- .EXE
- RECYCLERS.EXE
- ..EXE
- WARCARFT.EXE
- WIN9X.EXE
- WC3THAIFONT.EXE
- MAIL.GOOGLE.COM.EXE
- FORMS.EXE
- CONFIG.MSI.EXE
- TCG.EXE
- SUPPORT.EXE
- WORLDEDIT.EXE
- README.EXE
- LAYOUT.EXE
- IMAGES.EXE
- NAV.EXE
- CLANICONS.EXE
- BATTLENET.EXE
- SCREENSHOTS.EXE
- I-MOBILE.EXE
- SAN-X.EXE
- BARCDRED.EXE
- T[1].EXE
- M.EXE
- L.EXE
- T.EXE
- G.EXE
- V5.EXE
- $VAULT$.AVG.EXE
- 0001.EXE
- 0404.EXE
- 0409.EXE
- 0412.EXE
- 041E.EXE
- 0804.EXE
- DC192.EXE
- 101MSDCF.EXE
- 100NIKON.EXE
- DE356.EXE
- #WWW.GAMEZHERO.COM.EXE
- S-1-6-21-4564564512-1075880115-910321303-3161.EXE
- S-1-6-21-6129016431-0312943124-490191164-4243.EXE
- I.R 07-2008.EXE
Filesizes
The following file size has been seen:
- 489,472 bytes
- 337,947 bytes
- 702,418 bytes
- 268,216 bytes
- 268,288 bytes
- 506,995 bytes
- 659,896 bytes
- 428,032 bytes
File Type
The filename RVHOST.EXE is used by multiple object types including objects,executable programs,objects.
File Activity
One or more files with the name RVHOST.EXE creates, deletes, copies or moves the following files and folders:
- Deletes c:\windows\system32\drivers\hlmfln.sy
- Creates c:\windows\system32\drivers\hlmfln.sys
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.