Versions

1, 0, 0, 596	16.33%
1, 0, 0, 556	8.16%
1, 0, 0, 549	2.04%
1, 0, 0, 548	2.04%
1, 0, 0, 545	24.49%
1, 0, 0, 501	4.08%
1, 0, 0, 501	2.04%
1, 0, 0, 493	8.16%
1, 0, 0, 462	22.45%
1, 0, 0, 453	2.04%
1, 0, 0, 448	2.04%
1, 0, 0, 339	2.04%
1, 0, 0, 241	2.04%
1, 0, 0, 210	2.04%

Warning 20 antivirus scanners has detected malware in various versions of GuardMailRu.exe.

There are 14 versions of guardmailru.exe in the wild, the latest version being 1, 0, 0, 596. It is started as a Windows Service with the name 'Guard.Mail.ru'. During installation, a run registry key for all users is added that will cause the program to run each time any user logs on to Windows. The average file size is about 2.35 MB. The file is a digitally signed and issued to LLC Mail.Ru by Thawte. Numerous variations of guardmailru.exe have been installed with both [email protected] and Guard.Mail.ru. During the process's lifecycle, the typical CPU resource utilization is about 0.0014% including both foreground and background operations, the average private memory consumption is about 3.5 MB with the maximum memory reaching around 9.49 MB. Addionally, typically read and write I/O disk operations is about 979.23 KB per minute for reads and 300.21 KB per minute for writes.

Based on 40+ industry antivirus scanners, 20 of them detected the following malware.