Follow:

 

Virus:DOS/Rovnix.D


Microsoft security software detects and removes this threat.

This trojan tries to install other malware, including Trojan:Win32/Claretore.L. It can cause your PC to crash.

If you can't reboot after the crash, you might have to reinstall Windows.

This threat can be installed on your PC by an exploit. Our exploit information page has more information about how this happens.



What to do now

The following free Microsoft software detects and removes this threat:

However, in some cases you may need to use the free tool Windows Defender Offline to fully clean your PC:

The following articles may help if you're having trouble getting the tool to work:

After you've used Windows Defender Offline, you should make sure your security software is up to date and run a full scan:

Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.

You can also visit the Microsoft virus and malware community for more help.

Update Java

We have seen this threat being distributed by malware that exploits Java vulnerabilities. We recommend you take the following steps once you have reinstalled your operating system and security software:

You should remove older versions of Java, as keeping old and unsupported versions of Java on your PC is a serious security risk:

If you continue to get alerted about this threat, deleting your temporary Java files can help:

It's also important to keep your other software up to date:

Run the Bootrec.exe tool

To completely remove this threat you might need to run the Bootrec.exe tool using your Windows installation CD.

For Windows 8:

  1. Put your Windows 8 media in the DVD drive and restart your PC.
  2. Select a language, time and currency, and keyboard or input method, and then click Next.
  3. Click Repair your computer.
  4. Click Troubleshoot, then Advanced options.
  5. Click Command Prompt and then type Bootrec /FixBoot and then presss Enter.
  6. Type Exit and the press Enter.
  7. At the Choose an Option screen click Continue.
  8. Remove the Windows 8 CD from your DVD drive and restart your PC.

For Windows 7:

  1. Put your Windows 7 media in the DVD drive and restart your PC
  2. Press any key when you are prompted.
  3. Select a language, time and currency, and keyboard or input method, and then click Next.
  4. Click Repair your computer.
  5. Select the operating system that you want to repair, and then click Next.
  6. In the SystemRecovery Options dialog box, click Command Prompt.
  7. Type Bootrec.exe /fixboot, and then press Enter.
  8. Remove the Windows 7 CD from your DVD drive and restart your PC.

Threat behavior

Trojan:DOS/Rovnix.D can be distributed by malware exploiting Java vulnerabilities, or installed by other malware, for example TrojanDropper:Win32/Rovnix.H.

This trojan can cause your PC to crash unexpectedly. If you can reboot after your PC crashes, we recommend you run a full scan with a complete antivirus solution like Microsoft Security Essentials.

You might need to reinstall your Windows operating system and other PC programs, and restore your files and data from backup.

Additional information

Trojan:DOS/Rovnix.D is the detection for a malicious Volume Boot Record (VBR) which is loaded at boot time. It tries to tamper with some Windows kernel data to load its own malicious driver. This trick might bypass the Driver Signature Enforcement on a 64-bit system.

The malicious driver injects other malware components, for example Trojan:Win32/Claretore.L, into the explorer.exe process.

To hide its presence on your PC, the loaded driver intercepts the hard disk I/O (input/output) operation, and returns the original clean copy if the VBR is accessed.

Analysis by Chun Feng


Symptoms

Alerts from your security software may be the only symptom.


Prevention


Alert level: Severe
This entry was first published on: Apr 04, 2013
This entry was updated on: Feb 17, 2014

This threat is also detected as:
No known aliases