RVHOST.EXE is observed to show the following behavior:
- Disables task manager (taskmgr) or auto-closes the window
- Auto-closes the Microsoft configuration (msconfig) folder
- Adds registry entries
- Adds itself in the windows start-up list (automatically starts when windows starts
- Infects External Storages by creating autorun.inf files
- Adds a process with image name RVHOST.EXE
- Disables Registry editing