Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner2.24106
Added to the Dr.Web virus database:
2016-05-20
Virus description added:
2016-05-20
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%HOMEPATH%\aegvvp.exe'
Malicious functions:
Executes the following:
Injects code into
the following system processes:
Modifies file system:
Creates the following files:
Sets the 'hidden' attribute to the following files:
Network activity:
UDP:
DNS ASK mu###.###tal-protection.net.ru
DNS ASK sl###.##fehousenumber.com
'mu###.###tal-protection.net.ru':33111
'sl###.##fehousenumber.com':33111
Miscellaneous:
Searches for the following windows:
ClassName: 'Dfsyemkc. Gjsxetsu' WindowName: 'Frprbesy Xbehons'
ClassName: 'Blruns Txukq Tn. A' WindowName: 'Wwtthxvhp Xu. Wg'
ClassName: 'Tqanqwj Gf' WindowName: 'Dhgdqk Yvkpca Fxsnf, Fkxiqsh'
ClassName: 'Fkxiqsh, Tqanqwj Gf' WindowName: 'Dhgdqk Yvkpca Fxsnf'
ClassName: 'Tyqaoq Fuwjw Jgla' WindowName: 'Hmndu, Qfk Jpoxgtd'
ClassName: 'Vcrqety. Ipamqvslt' WindowName: 'Bqrllqbr Aoqg J'
ClassName: 'Xnv' WindowName: 'Wfhgps, Fdph, Iqqhn, Evoejxf Mmru'
ClassName: 'Tscqvro Qgqfge U' WindowName: 'Ftlxkw Hujfdsb Yc'
ClassName: 'Ywhyeqq Uclhkqlmyah' WindowName: 'Rwh, Hfwuoqe. Arw'
ClassName: 'Pfqyap Piehe Ct' WindowName: 'Rckg, Guxwmr Mpah'
ClassName: 'Uosei Jaclnnb Ypw' WindowName: 'Fwcqt Lyslq. Kdqix'
ClassName: 'Mrndta Mknab Ilh. J' WindowName: 'Hfxkb. Xlbsmv Fvl'
ClassName: 'Aggpsd Rnphvlug' WindowName: 'Vydp. Gujn Vlodk'
ClassName: 'Wwqlpx Xsbx Ixxnea' WindowName: 'Dxqyfol, Ssee Uuex'
ClassName: 'Ffh' WindowName: 'Qkr. Qvgrofku Rkd, Onhjuas Xv'
ClassName: 'Onhjuas Xv, Ffh' WindowName: 'Qkr. Qvgrofku Rkd'
ClassName: 'Sgjydw Xphhlhg Kn' WindowName: 'Tgvmfip, Xw. Gkg'
ClassName: 'Anskbag Esguiw. Rtw' WindowName: 'Xajdx, Fvbytk F'
ClassName: 'Evoejxf Mmru, Xnv' WindowName: 'Wfhgps, Fdph, Iqqhn'
ClassName: 'Nia. Oohkm Akuc' WindowName: 'Nqqjuw. Ahol Jmbg'
ClassName: 'Rwivscs Rssgyopiul' WindowName: 'Fif. Uoq Peyf, G'
ClassName: 'Qdy' WindowName: 'Derq Honphyu Whx, Fhjt Tvjdfh'
ClassName: 'Fhjt Tvjdfh, Qdy' WindowName: 'Derq Honphyu Whx'
ClassName: 'Wqcstvwp Kmjmplqe' WindowName: 'Ftqrpsj, Nhsuwgahr'
ClassName: 'Luxtvaa Fjtdkffi' WindowName: 'Qocsya Rnf. Hhlq'
ClassName: 'Wugte. Voedep Lp' WindowName: 'Nqjhglax Yageknb X'
ClassName: 'Adqn. Mel Kmaic' WindowName: 'Sakmeaajhs Hrwi'
ClassName: 'Sckrvvinkn Mqdxas' WindowName: 'Drmb, Ra. Dpy O'
ClassName: 'Hkvcuitf Ylw. K' WindowName: 'Kkrgnpd, Igrnn, L'
ClassName: 'Twsfdbg Xrqy Rxbkm' WindowName: 'Mmjs Iqhukx Djek'
ClassName: 'Yu' WindowName: 'Gcjcvw. Px, Oiqsnt, Mudhj Npaja Wt'
ClassName: 'Mudhj Npaja Wt, Yu' WindowName: 'Gcjcvw. Px, Oiqsnt'
ClassName: 'Kqpel Arem Tniqyq' WindowName: 'Pdwitow Pnul, Oc'
ClassName: 'Eukdyqxk Jmq Qb' WindowName: 'Utkykrx, Th. Sdd'
ClassName: 'Hwdgspvy Unfkmx' WindowName: 'Eoqljyijc Sl. Qtmsn'
ClassName: 'Ojup. Cce. Iduu' WindowName: 'Ownytc, Snkb Tlhew'
ClassName: 'Klknxqv. Nholujriv' WindowName: 'Hvthku. Ajsivks Y'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK