PARA USUARIOS

Mi biblioteca

+ Añadir a la biblioteca

Buscar

Soporte 24 horas | Normas de contactar

Escribir

una solicitud al rellenar un formulario

Llamar

+7 (495) 789-45-86

Foro

Sus solicitudes

Todas: -
No cerradas: -
Última: -

Crear una nueva solicitud

Llamar

+7 (495) 789-45-86

ES

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

Entrar en el analizador

Peritaje de IIV

Biblioteca de virus

Base de conocimiento

Tecnologías

Términos

Formación y educación

Mitos

Mitos sobre los antivirus

Win32.HLLW.Autoruner1.34255

Added to the Dr.Web virus database: 2013-03-21

Virus description added: 2013-03-22

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Internet Service' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Windows Internet Service] 'Start' = '00000002'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\<Virus name>.exe

Malicious functions:

Creates and executes the following:

%WINDIR%\Temp\AUT0EXEC.BAT
<SYSTEM32>\Windows Internet Service.exe
%WINDIR%\Temp\AUT0EXEC.BAT (downloaded from the Internet)

Executes the following:

<SYSTEM32>\taskkill.exe /f /im KRegEx.exe
<SYSTEM32>\taskkill.exe /f /im KVSrvXP.exe
<SYSTEM32>\taskkill.exe /f /im UIHost.exe
<SYSTEM32>\taskkill.exe /f /im KVXP.kxp
<SYSTEM32>\taskkill.exe /f /im KvMonXP.kxp
<SYSTEM32>\taskkill.exe /f /im KVCenter.kxp
<SYSTEM32>\taskkill.exe /f /im Logo_1.exe
<SYSTEM32>\taskkill.exe /f /im Rundl132.exe
<SYSTEM32>\taskkill.exe /f /im 360tray.exe
<SYSTEM32>\taskkill.exe /f /im TrojDie.kxp
<SYSTEM32>\taskkill.exe /f /im FrogAgent.exe
<SYSTEM32>\taskkill.exe /f /im Logo1_.exe
<SYSTEM32>\taskkill.exe /f /im UpdaterUI.exe
<SYSTEM32>\taskkill.exe /f /im TBMon.exe
<SYSTEM32>\taskkill.exe /f /im scan32.exe
<SYSTEM32>\taskkill.exe /f /im Mcshield.exe
<SYSTEM32>\taskkill.exe /f /im VsTskMgr.exe
<SYSTEM32>\taskkill.exe /f /im naPrdMgr.exe
<SYSTEM32>\taskkill.exe /f /im Rav.exe
<SYSTEM32>\taskkill.exe /f /im Ravmon.exe
<SYSTEM32>\taskkill.exe /f /im RavStub.exe
<SYSTEM32>\taskkill.exe /f /im Ravmond.exe
<SYSTEM32>\taskkill.exe /f /im CCenter.exe
<SYSTEM32>\taskkill.exe /f /im RavTask.exe

Terminates or attempts to terminate

the following user processes:

360tray.exe

Modifies file system :

Creates the following files:

C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cs[1].exe
%WINDIR%\Temp\AUT0EXEC.BAT
C:\<Virus name>.exe
<SYSTEM32>\explorer.exe
<SYSTEM32>\Windows Internet Service.exe
<Current directory>\Autorun.inf

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\<Virus name>.exe
<Drive name for removable media>:\autorun.inf
C:\autorun.inf
<SYSTEM32>\explorer.exe
C:\<Virus name>.exe

Network activity:

Connects to:

'www.hk##r.cn':80
'localhost':1035

TCP:

HTTP GET requests:

www.hk##r.cn/cs.exe

UDP:

DNS ASK www.hk##r.cn

Miscellaneous:

Searches for the following windows:

ClassName: 'IEFrame' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''