home

RarExt.dll

WinRAR

Alexander Roshal

This is the Windows Shell Extension for WinRAR which provides the full RAR and ZIP file support, can decompress CAB, GZIP, ACE and other archive formats. The library RarExt.dll, “WinRAR shell extension” has been detected as malware by 39 anti-virus scanners. According to the AV engines that detect this, it is a detection for a file infected by members of the Win32/Ramnit malware family and may drop and load other malware.
Publisher:
Alexander Roshal

Product:
WinRAR

Description:
WinRAR shell extension

Version:
4.20.0

MD5:
76d902ff68cb94e53e417e224278e92c

SHA-1:
2baf8959b369b15a48f5f72dc0f724e98707c1d5

SHA-256:
684ba138cbcd47b3e63c250570de38376e38d212d4ff0434436ec366142cc1d8

Scanner detections:
39 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
4/25/2024 9:24:07 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Ramnit
6475091

Agnitum Outpost
Win32.Ramnit.Gen.3
7.1.1

AhnLab V3 Security
Win32/Ramnit.B
2015.01.29

Avira AntiVirus
W32/Ramnit.A
7.11.205.178

avast!
Win32:RmnDrp
150101-1

AVG
Win32/Ramnit.A
2014.0.4253

Baidu Antivirus
Virus.Win32.Nimnul.$a
4.0.3.15128

Bitdefender
Win32.Ramnit
1.0.20.140

Bkav FE
W32.RammitNNA.PE
1.3.0.6379

Clam AntiVirus
W32.Ramnit-1
0.98/19988

Comodo Security
Virus.Win32.Ramnit.A
20878

Dr.Web
Win32.Rmnet
9.0.1.05190

Emsisoft Anti-Malware
Win32.Ramnit
9.0.0.4799

ESET NOD32
Win32/Ramnit.A virus
7.0.302.0

Fortinet FortiGate
W32/Ramnit.C
1/28/2015

F-Prot
W32/Ramnit.B
4.6.5.141

F-Secure
Win32.Ramnit
5.13.68

G Data
Win32.Ramnit
15.1.25

IKARUS anti.virus
Virus.Win32.Ramnit
t3scan.1.8.6.0

K7 AntiVirus
Virus
13.193.14786

Kaspersky
Virus.Win32.Nimnul
15.0.0.543

Malwarebytes
Virus.Ramnit
v2015.01.28.01

McAfee
Virus.W32/Ramnit.a
16.8.708.2

Microsoft Security Essentials
Threat.Undefined
1.191.3474.0

MicroWorld eScan
Win32.Ramnit
16.0.0.84

NANO AntiVirus
Virus.Win32.Nimnul.bpchjo
0.30.0.65070

Norman
Win32.Ramnit
02.01.2015 13:58:24

nProtect
Win32.Ramnit
15.01.28.01

Panda Antivirus
W32/Cosmu.gen
15.01.28.01

Quick Heal
W32.Ramnit.A
1.15.14.00

Rising Antivirus
PE:Win32.Ramnit.a!1590234
23.00.65.15126

Sophos
Virus 'W32/Patched-I'
5.10

Total Defense
Win32/Ramnit.A
37.0.11409

Trend Micro House Call
PE_RAMNIT.H
7.2.28

Trend Micro
PE_RAMNIT.H
10.465.28

Vba32 AntiVirus
Virus.Win32.Nimnul.a
3.12.26.3

VIPRE Antivirus
Threat.4726519
36666

ViRobot
Win32.Ramnit.E[h]
2014.3.20.0

Zillya! Antivirus
Virus.Nimnul.Win32.2
2.0.0.2048

File size:
220.5 KB (225,792 bytes)

Product version:
4.20.0

Copyright:
Copyright © Alexander Roshal 1993-2012

Original file name:
RarExt.dll

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\winrar\rarext.dll

Registration
CLSID:
{B41DB860-8EE4-11D2-9906-E49FADC173CA}

COM registered:
Yes

File PE Metadata
Compilation timestamp:
6/9/2012 4:20:02 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:aZohUhHXaF72eQxbqnx0/Nw1s5miAkU7BMw:4hHXaF72eQxbqO/NGEU72

Entry address:
0x36000

Entry point:
60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, 32, 6F, 01, 20, 2B, 85, 50, 72, 01, 20, 89, 85, 4C, 72, 01, 20, B0, 00, 86, 85, 9E, 74, 01, 20, 3C, 01, 0F, 85, DE, 02, 00, 00, 8B, 85, 4C, 72, 01, 20, 2B, 85, 58, 72, 01, 20, 8B, 00, 89, 85, EA, 73, 01, 20, 8B, 85, 4C, 72, 01, 20, 2B, 85, 5C, 72, 01, 20, 8B, 00, 89, 85, F2, 73, 01, 20, 83, BD, F2, 73, 01, 20, 00, 0F, 84, A9, 02, 00, 00, 83, BD, EA, 73, 01, 20, 00, 0F, 84, 9C, 02, 00, 00, 8D, 85, 8D, 74, 01, 20, 50, FF, 95, EA, 73, 01, 20, 83, F8, 00, 0F, 84, 86...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
113.5 KB (116,224 bytes)

Remove RarExt.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.