Exterminate It! Antimalware

malpedia

Known threats:700,085 Last Update:August 24, 10:09

Testimonials

After scanning my computer many times using big name anti-virus and malware programs I still had several problems. Finally Exterminate It found multiple infections from NetSky. I sent Exterminate It a sample and the next day I received an e-mail instructing me to update and rescan. After following the instructions ZAP the worm/trojan was gone. My computer seems to be completly back to normal now. Good Job Exterminate It!

Melvin

File: ro

Location of ro and Associated Malware

Check whether ro is present in the following locations:

ro file locations that are Windows version independent:

  • C:\Windows\ro

If you find ro file in any of these locations, your computer is very likely to be infected with the following malware:

IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The ro file is associated with malware only if found in the locations listed above.

Notes:

Different Variations of ro File^

File SizeFile Md5Last Seen
96454DC453294FCAAA9A7C2458A7A9E94CDApr 28, 2010
964BD1B5E4E12AE861532515F276D1D3D99Jun 2, 2010
1928C79B712E57BC321985DCFD9EAC2C0F84Jun 10, 2010
9646B906EDA8E11BE10A157B0C6C65C937BJun 15, 2010
9646BCD3B7CFEDAA65CF5686C3C65C79B52Jun 19, 2010
9648599A53327EF5D2A7F93B3A4E14822B6Jun 27, 2010
964071837A2E982AFF5AA4D96BF1BCEDFBDJul 1, 2010
19285A742212C6D661BF764E2D805CFEB6DAJul 2, 2010
964475138D6B853CCC6633250882E12AAA2Jul 5, 2010
9640014A33B1F787DF921F32F363F30FB4AJul 6, 2010
964E3FD7BB3C76A9C97C87201882873340CJul 6, 2010
964F711F1998D462BF0B19167652D49E72FJul 6, 2010
19283E7C533FA50A130CC3AEA211C0F6A990Jul 9, 2010
9644621BA3DF94F114BD874CAA67447AA7BJul 9, 2010
964ED2C7378BF9C1E4A1436721FC330CF38Jul 9, 2010
9645B3805E9761491504124692B50608AACJul 11, 2010
676069AFC694E84CB27EDAE759E31422B99EJul 19, 2010
96429094C3BC076923CE61AE426E6256322Jul 20, 2010
964145B9115346D968E04CD96F397EB1EA7Jul 21, 2010
964627EEEC7FE8E2AD66DDA9F1701AD5DF1Jul 21, 2010
1928FCA9CD521E6E2D8FFC9ECA90BA25015BJul 24, 2010
19280AD9B566145B25C72800E08625DDECF9Jul 25, 2010
9641C5FF132D7DB36BE1CD93852E4E34BD2Jul 25, 2010
96442DE3487D9D2B39599B3636CAA46106CJul 25, 2010
19283EAE912BCD4CBC55604421EAA9CACC33Jul 26, 2010
1928D86559FA44C11DAE32137CE5C667E6D4Jul 26, 2010
19282A778AEB396BB7037EA21AE21BE1C42BJul 26, 2010
964C74FED0F4B56A18865EE2DE7F895CDD1Jul 26, 2010
96493E7F4FA2918464C9EA96CE9488BDDEFJul 26, 2010
96433D59F4951E18509084AA2D689E2C1A3Jul 26, 2010
964263C0A28C2D90D4A1DAD2D65834E8C79Jul 26, 2010
964F64133F4CDEDCEE629EE30C2BA195B30Jul 26, 2010
1928DDBB4C8CE82B0630036DA2D020C86484Jul 28, 2010
96453A7D96CF7B8D3F0BC52A8CAD6B32C2CJul 29, 2010
964B873479E30F235612AEE7F1AF94878A9Jul 30, 2010
9641F13D7ECC10B669707B4183781B03DBCJul 31, 2010
2024B3765D75C1C37834978732E493D0E049Aug 1, 2010
96481690C55D9A0A02B724BC240B48E5FADAug 5, 2010
4051B765D83BA830AE75E1CCA5DCBCBA3F39Aug 6, 2010
964EEFEA96089084265B1424652CCD59C6CAug 7, 2010
9647CA9DB0CD7F790195BDE2D2803419C81Aug 7, 2010
202439B6B22A29E86DB1B7FE76F64DFBEAEAAug 8, 2010
964FE4A266F02F003A6C747D36132D3DA1AAug 9, 2010
96447E8F5F5B9F6561101E65FBA9C41D58EAug 9, 2010
198237CEEA372DAA0CCADE6106D646588EB1Aug 10, 2010
2940927FE8F2380413B1A8B451CF256D70D3Aug 10, 2010
1928710937F9973C0F71373F911EC3540AFDAug 11, 2010
964B376EE9D61E27718C7A621D6AFF9916EAug 13, 2010
20007406EABA0AF87CF07D01E86B3DB1A67DAug 17, 2010
10123763A3F1F5D423776E5E6F8DCFE2EFD0Aug 17, 2010
198837E023F1BE81338B508C89817135EEDDAug 19, 2010
964C1CA8726E4F80D157845EBB1D4F8EE69Aug 21, 2010
964E5A16B52B6082FA9A13EDF3BB3353B8DAug 21, 2010
28927AD60B8A12A7E44B14F695EDA01AE0D0Aug 23, 2010
20249CB40DCF4AB33676876B260025C97336Aug 24, 2010
9646FCAE1B0D0AF0ACCB351000231C403C2Aug 30, 2010
1012D4004A87CCAB1CB96A72755ECA62B90DAug 30, 2010
10090FBA322CF82C3AD9C7BB500F865F2CD7Sep 8, 2010
1955218240C656AFCB54042AC32E91D94201Sep 10, 2010
20243273745505E0D543FFA8B97688DF8842Sep 12, 2010
29466F7FE5410A966FA0F6906181A85D405CSep 14, 2010
1012670A8BBA4C702488B7DF7AEF54ACE05BSep 15, 2010
2024CEB78C1AA3FA734F6EE3781240DE93ABSep 16, 2010
20244BAB7DE86F7A61B80CDFD041C41973EBSep 17, 2010
1012829B648627A4A41469DFEE3D3B0D1CDCSep 18, 2010
19288BA67614E4D5C680CA1BC50E66C8B7CBSep 19, 2010
30332DBAB2E806328AC7A9BF6EB2229C3A47Sep 22, 2010
20243EC4BBE87375723869B48FC21A7E4E8FSep 27, 2010
9126E3CE5C3974A12C9E706993BA72544272Oct 3, 2010
2892B9298A2E7DCE833779F0B0DDCD94EA19Oct 3, 2010
964A2A772484DB1CDA70E87546778498761Oct 3, 2010
101284BEAFA94D585B99127010F04AE89F68Oct 5, 2010
1976C2C9C51E6BAEA7B1F9D782CEB9106830Oct 5, 2010
997636E3E6B6F2ED702642C1FEF336C04B1Oct 8, 2010
6991D43D8F56F2AD6662D115690A1DAAAAD9Oct 8, 2010
101274DEAF74215FC1B6759CB423AD8E6472Oct 12, 2010
9648389043A7AF5427CBB0BCAA3D2DE8B31Oct 12, 2010
19949E453EA97BB5D3D54332480A9AF5ACDDOct 13, 2010
1988EAB27FB8F34D81E18F5D8EAFE9510A1FOct 13, 2010
20062C140B0AA88143D0BE068C0D944BF2E9Oct 14, 2010
503011617E55B49BF989203AE66275A9CE57Oct 14, 2010
99492B4A352E6B384AA3AFF4962035F210BOct 14, 2010
2024DB2D6D7AA4C220AE15935DDA1DFF8D45Oct 16, 2010
2024F4DD95442BABC552499E026684FBF0C5Oct 16, 2010
9648D29E1F785F55A0B273D73AE5625F5C8Oct 16, 2010
964F93D983726AEFE262AA1D7C5AF67C712Oct 16, 2010
1012F1BC1F213107602061D7788DBE985278Oct 17, 2010
997E23078AACAC66017857BBC9FC88907BFOct 18, 2010
100361AB57BD99C92C1E5C1CF09EED668DA9Oct 19, 2010
10127F1DBECC55B53BD24B5FBC43226A0850Oct 19, 2010
1009AF80C0789E16F926A26FABF84BBAC54COct 21, 2010
50215ED6D8D9DB0482DE385F8143F422F451Oct 21, 2010
9645190C99E1D5C09689DC3F3A3AD964F76Oct 21, 2010
1928A449F9BDF3150384B79248447FF7735AOct 24, 2010
1012D96E0866270D077D573ACB391E63591AOct 24, 2010
1012969A54FDF82057E7CB53C25673105C55Oct 27, 2010
1009F33E7D81614F4F468ABB2DF8B13CF183Oct 27, 2010
10120726FD745530A8BD2492DA1F9CE2C98FOct 28, 2010
198852D2D18ADDBF21022096D7D054206C3EOct 29, 2010
10126D650A3105931EFB3325912BC2775D38Oct 29, 2010
2991F710FA436E6E70DCB62946EC8BBF1564Nov 1, 2010
964E2332E7E06DCB738E9D194841F849FF0Nov 2, 2010
10090632517D4664E0DB214E47C4A64F0AE1Nov 3, 2010
101256210822E3EC02E8769AB7883003CDF6Nov 4, 2010
2006CCC0458F58EF444981429308113001D5Nov 6, 2010
50666344D4A02964C6FAD8F4B4336290938BNov 7, 2010
100390C976E8B5CF9F3A58A0D3D159848309Nov 9, 2010
2991C4371127F58BFE57071560E7BE6BF330Nov 9, 2010
202424462946B0DD29E3F9603281695A70D5Nov 10, 2010
100386C1406272620BC31366663404105562Nov 10, 2010
20246EB8A7B0E19317ECD1AAC4E0CA4960EFNov 10, 2010
1009F869C15437B023DE3FEB0B21029B078ANov 10, 2010
19885190F0C15651997F5BBCDBDF02EBD4B0Nov 13, 2010
101210F3F07150B9FBCF5B1E72786ADF3D1ANov 14, 2010
100976E767FC89789501479F98D36293ACFDNov 17, 2010
2024A25910331DAE2214A7DE86FFF28D409FNov 18, 2010
100946A1B18DE49B52FE1076B41E645D8E27Nov 18, 2010
1994BEB706DC65F6E32F99EB088C056E67CFNov 22, 2010
602792BB5D5950100FC0AC750C0A71A6A6A8Nov 26, 2010
1003A97250EB0AA6ACF16CEF4751A213E647Nov 29, 2010
3009695F797C92B79493B2ADDF3DBD58AB57Nov 30, 2010
7033B3E35266198EFB42FED0B6C0B6D2DF1CDec 3, 2010
9919DD5908565A73043EF18930259B5575CDec 6, 2010
2006E333857A0B204449C0CA33CB32108CF7Dec 6, 2010
20248FA1CA7B195A12852A838ABED7DA9932Dec 7, 2010
120338BAA4769E3E63A81C557FFCAE469A6D9Dec 9, 2010
3979CDF5750C8AD786BC0D022A1F493833B8Dec 12, 2010
100304986AB215C6BC567A64DD5B6640A803Dec 13, 2010
59379C085375BCAE70145A37C37BEF39D670Dec 14, 2010
202188AE2051ADB3BDC82B961AC21893DB48Dec 14, 2010
1003FCE05D147613151B10498218A28A2550Dec 15, 2010
20186B56B4415D3F0755E1BBEECE1A949AEFDec 15, 2010
19765001C5F1D3BA8885869B5BBE98FC8032Dec 16, 2010
2018058E0747084DC516471EC740A827C810Dec 16, 2010
10038BD94BE498FFE282922503353039E65CDec 21, 2010
1009336E397D6F27DDA59500443E06C43CEBDec 23, 2010
997F7ACF72F3F4F89132FF35287EA49ADA1Dec 23, 2010
171504C01B5E8792F7B7E7FEED73E72F379ADDec 25, 2010
3027F4A21DB8AD775FAA9FAEAD09D7B87C8ADec 29, 2010
99418152DA4FE8B0CE6ED084517FB326577Dec 29, 2010
1009D5D8AB8300A1C919CF3A98152F84AB19Dec 30, 2010
10123891D8A76481C716FC355D974EFC1FC9Dec 31, 2010
393757E8B40AA13601BA97FA815A4395E837Dec 31, 2010
4024A1B93F8CE8B0CBCCBED25859AEC7D309Jan 3, 2011
2024478EFB83C6ACD6497F5DA365971C48FFJan 3, 2011
994CD71975BA2B6B4DC1E92B6D71F344684Jan 3, 2011
50035540609E8536866E457D5949437D810AJan 5, 2011
3036E6936109063EC4024D9D9776DFC54206Jan 5, 2011
29851E44656F488746FFE23B69A51BCF5375Jan 5, 2011
9640A01C7EE20616EF58913DB06304B92BAJan 6, 2011
100961DC58AEE40149B87228ED1387A164B8Jan 8, 2011
200636B76903F7B06EBF5CF95925ABC8C93DJan 11, 2011
1003BB79A260F8C250CC31D7864C8CFF043CJan 11, 2011
39073D0DA413CC04DCDDDCEF06468F341279Jan 11, 2011
6081C3A4C4C1662F2AFD4F63A454822CEDF2Jan 11, 2011
49829C933439D660A5371346343E61D901B0Jan 20, 2011
10007AC4C1BF240953C5B27512094DB53460Jan 25, 2011
994872FBE513B4190DC599ACB0254A190BFJan 25, 2011
964602C36474BF03B1FD973BAFDE7B4F504Jan 25, 2011
3991CC67D334BE0263BDBBF2F0D5D656CADDJan 25, 2011
1012F4131D5D6878F2A9522A01AD4AF92668Jan 25, 2011
9976A6AC84C698BE2E19C1E6D6F106FDF09Jan 25, 2011
10032E09892D84D15948439783A44CE2F166Jan 26, 2011
1003D742A45A7BB46CCC4B4A3B8B5361BD9AJan 26, 2011
40031FA5F63411DF08E633AEFDFF692D9F1AJan 31, 2011
198868AB4B2454F32C321AAE2F6C945434B9Jan 31, 2011
100356390920CE6BA5993BEA897B288E9521Feb 1, 2011
1955548BF1BB9D8789DEDCD9CC4578713D2DFeb 3, 2011
29704E734D0F16240FC06DCB98699BAB3719Feb 4, 2011
1009F5C0461F29722EFFDF7943A055006B79Feb 4, 2011
9640A6F01C5417705160F6F0B9ECACA14E8Feb 6, 2011
1003777A8999BA5AF09D8362D488A82BF63CFeb 9, 2011
10091B58E56280BB2A94C622A4012F70FFB6Feb 13, 2011
10126A97CDDA16B3C3F8BF4E35CDED49B426Feb 13, 2011
2006790EA499F01374A9BF0948243068D3B5Feb 13, 2011
10129591A16E5F72C473D224FEB09C60FD72Feb 14, 2011
1012C56A229571761016D60A34C2BE4FC6D5Feb 15, 2011
10122F8D4B08D11DE8C10BD64CFA46443F26Feb 16, 2011
1012D09B73C4FF26B34A52CAA9D95030C5A5Feb 28, 2011
2024CBDA5C51A2EF847650B5DA4C870BC699Mar 3, 2011
4048CE25BDF48B8FBC28CA60D14C1450C2C0Mar 4, 2011
3928AA845A9900525251A63CCB1CD07973F6Mar 5, 2011
100384F1CEF7434D3336C66024DE81409270Mar 5, 2011
1012987FE6485B24F5D7628DB8E272BA739FMar 8, 2011
10095AF3C31084EA06D340DF8C48FB3971FBMar 8, 2011
10034BF0C3D914DF4CF8F315C3994087A54BMar 16, 2011
397976835F1FFDA81B4E48BE081752E2FCA1Mar 16, 2011
2018AC7B6E5AFB237037C6238920A3171161Mar 18, 2011
1000CCB4B312CD1CAB9892AB0F632FB1CD86Mar 21, 2011
9646695025D97F6027663EF633A1F1F9CA2Mar 22, 2011
29405A1A119CF1F0A25E5545560FCA78809CMar 22, 2011
4051938D14F4170213B33D9FA4BB6829644EApr 2, 2011
2024CFB3182F428AC7EA6BCEF750CEED34E5Apr 5, 2011
9646891076B45F7D912F76167711A4D1F0FApr 6, 2011
396106F58A77BE87CCF4C669558ED135822EApr 8, 2011
1009A842F34CAF0FAA0CA54B089C20C9CC3EApr 14, 2011
2015529628569ADC25BC3CBC72AB80A84E7FApr 18, 2011
964D598633618C342C105D43EEE0FA4D9DCApr 21, 2011
1009141D41142D57494E020CDD4498E26F25Apr 25, 2011
39910DB8DF4FA7C8197228F1E9390BA724C3May 5, 2011
1009A41A1BCC1D01A48CFBA3C75AF39B0C10May 6, 2011
964584ED662B5C9B004D8A68AB45D7E2DACMay 9, 2011
404546930EB15E668CBC19A1AF30F2F1653EMay 24, 2011
2024952DD7877F3A182382F5C961704781CBMay 28, 2011
10064DEB39F2570CF37D330AB9BD7E1323AEJun 1, 2011
100004A57DC7CDEDB38F29C4CB2DE1C717B0Jun 3, 2011
9913C4611A751CEA45F65D8275FF1E12828Jun 4, 2011
19761E56831855673494BE61EECEDAD444B7Jun 4, 2011
10128222357DF1D5D77F5BC9376FDCB17ED2Jun 6, 2011
10127E00C04998D4663D7DC1B5973CCC21F3Jun 16, 2011
80421112B70D43BD106569162441088CD2F0Jun 17, 2011
96402669392C82E68A4B2C5E3BD426B4AF0Jul 14, 2011
3003944EF5D22BB92A00548EE84D3A22CD66Jul 21, 2011
1009249940DADF2C12B419277A61A63F3AAAJul 23, 2011
991509734145CAFDA2B65E5BD3DCAB8DADEJul 24, 2011
101415CF793D50A20AA8E7157D94C902D0272Jul 29, 2011
3015E9C226E6DAFC6D2B32F57504983EB557Jul 31, 2011
69161F029C0ACE343B1CB3B5C6A01A22D730Aug 1, 2011
10038AB5E7BA5956867D54211F16D785478CAug 2, 2011
39341B90BBB9972053C107472DBB6912793FAug 5, 2011
9642C2B5BD680F424BB4F8DBE71303A3A21Aug 7, 2011
6991A7F2FE3A92B01FCBBD83F849547C8D21Aug 9, 2011
1003DE5333BE01A7E3425066C3392D92FD38Aug 9, 2011
997B58C3C22F15509104849CEBB211C26A7Aug 17, 2011
198894A1BEB59CC15C5640F776632FFDA882Aug 21, 2011
2024BC45375BD707C6ECF0B273C46BEA8445Aug 27, 2011
1009CCB1157CC7FFFA6BAF836C4C4A83BBCDSep 1, 2011
1012AD6AC315C1F684A326AF8E4C856C84C8Sep 2, 2011
3979E6BDA4D6B769BF257F01F5F495B63050Sep 9, 2011
1012C44664853CA033E5A8B1EF48FB474BCESep 13, 2011
1012B8AF8047BE812C9B0B29C4799041EC8FSep 18, 2011
2024C44023AABFB3ECD012C17FC6E0187F10Oct 1, 2011
2940731098411E7AB02F86A2FA3E91BB78B6Oct 5, 2011
20188E99A3AE26FEBAA7AD995F9165136F5COct 13, 2011
302432EEF9BEB331EBE265D6BD2E64B9EB3EOct 14, 2011
4051712989D7E01C396F590CF03772039889Oct 17, 2011
2006747E1F8E8736FED173ED8065795EF0DAOct 24, 2011
101206C859832A1E667FE1FEB47D8A2CD31AOct 25, 2011
19284D055E37B30424EB6865410CA8F20153Oct 26, 2011
30246222AB46B599A802E651FFE8DCDA64E5Oct 26, 2011
1003EA218EFC0DCF4D8BF125CF4056D925FEOct 27, 2011
10127FE105C063A8FE688EA99368C3B47B96Oct 30, 2011
9973B17D1040D7DD7D885A6B8B92A767FA4Nov 2, 2011
10039DF48EF68E1129DCD440D2045E104A81Nov 2, 2011
10033778180D88D1D68E54AB953B0FFF10E8Nov 7, 2011
96421F7CFE528416485D5C2F7AED278E608Nov 10, 2011
40158CDF0673D01075CFB2187DEB70C48FA0Nov 15, 2011
29887D5D0594CBFAA06D412109F9EEF47022Nov 22, 2011
10127C617E704E2289DB3E72C7C4EAE9406FDec 1, 2011
10092E972E3F0CCEC91857B4D87BF20A7D22Dec 4, 2011
10120E209381BD573ACBAE4AAF9DC2DE6B28Dec 5, 2011
2970C459BAB82AB9504DDB240D6E7993B54BDec 13, 2011
99783C432E5007B1F4190D94F62687F2A42Jan 28, 2012
49919D67EC2AA051AC1FD840482482D16688May 16, 2012
2021B04613A7C23C02A0EC34DFE2DBDBAB9ASep 12, 2012
1009F9FAD41B827F18FE46E368417FDD2C4DSep 23, 2012
101265A9DBFCBF6CC6D5CC0D960C21C4D906Dec 2, 2013

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.

How to Remove ro^

  1. To enable deleting the ro file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select ro and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of ro and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of ro and Associated Malware.
  6. Notes:

    • The deletion of ro will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of ro will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a ro malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type ro. The name of the first found registry value referencing ro is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to ro, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of ro and Associated Malware.