Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner2.5761
Added to the Dr.Web virus database:
2014-02-06
Virus description added:
2014-02-08
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%TEMP%\rundll.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%APPDATA%\hostsvc.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '%APPDATA%\hostsvc.exe'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\Sys.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)
blocks the following features:
User Account Control (UAC)
Creates and executes the following:
'%TEMP%\rundll.exe'
'%APPDATA%\hostsvc.exe'
'%TEMP%\rundll.sfx.exe' -pfudencoded -d%HOMEPATH%\Local Settings\Temp
'%TEMP%\hostsvc.sfx.exe' -pfudencoded -d%HOMEPATH%\Local Settings\Temp
'%TEMP%\hostsvc.exe'
Executes the following:
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Local Settings\Temp" +s +h
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
'<SYSTEM32>\attrib.exe' "%TEMP%\hostsvc.exe" +s +h
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\run.bat" "
'<SYSTEM32>\notepad.exe'
Injects code into
the following system processes:
Terminates or attempts to terminate
the following user processes:
outpost.exe
bdagent.exe
chrome.exe
AVP.EXE
Modifies file system :
Creates the following files:
%HOMEPATH%\My Documents\Downloads\MSN-crack.exe
%HOMEPATH%\My Documents\Downloads\MSN Gaming Zone-crack.exe
%HOMEPATH%\My Documents\Downloads\NetMeeting-crack.exe
%HOMEPATH%\My Documents\Downloads\MSBuild-crack.exe
%HOMEPATH%\My Documents\Downloads\microsoft frontpage-crack.exe
%HOMEPATH%\My Documents\Downloads\Microsoft.NET-crack.exe
%HOMEPATH%\My Documents\Downloads\Movie Maker-crack.exe
%HOMEPATH%\My Documents\Downloads\Online Services-crack.exe
%HOMEPATH%\My Documents\Downloads\Windows NT-crack.exe
%HOMEPATH%\My Documents\Downloads\WindowsUpdate-crack.exe
%HOMEPATH%\My Documents\Downloads\xerox-crack.exe
%HOMEPATH%\My Documents\Downloads\Windows Media Player-crack.exe
%HOMEPATH%\My Documents\Downloads\Outlook Express-crack.exe
%HOMEPATH%\My Documents\Downloads\Reference Assemblies-crack.exe
%HOMEPATH%\My Documents\Downloads\Uninstall Information-crack.exe
%APPDATA%\hostsvc.exe
%TEMP%\rundll.exe
C:\Sys.exe
%TEMP%\hostsvc.exe
%TEMP%\run.bat
%TEMP%\rundll.sfx.exe
%TEMP%\hostsvc.sfx.exe
C:\autorun.inf
%HOMEPATH%\My Documents\Downloads\FireFox-crack.exe
%HOMEPATH%\My Documents\Downloads\Internet Explorer-crack.exe
%HOMEPATH%\My Documents\Downloads\Messenger-crack.exe
%HOMEPATH%\My Documents\Downloads\ComPlus Applications-crack.exe
\Device\LanmanRedirector\CRNJEUFU\Program Settings\winadmin-setup.exe
C:\Program Settings\winadmin-setup.exe
%HOMEPATH%\My Documents\Downloads\Common Files-crack.exe
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\Sys.exe
<Drive name for removable media>:\autorun.inf
C:\autorun.inf
%APPDATA%\hostsvc.exe
C:\Sys.exe
Deletes the following files:
Network activity:
Connects to:
'wp#d':80
'au######on.whatismyip.com':80
'fu#####ded.no-ip.biz':80
'localhost':445
TCP:
HTTP GET requests:
au######on.whatismyip.com/n09230945.asp
wp#d/wpad.dat
UDP:
DNS ASK au######on.whatismyip.com
DNS ASK wp#d
DNS ASK fu#####ded.no-ip.biz
Miscellaneous:
Searches for the following windows:
ClassName: '#32770' WindowName: '(null)'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: '#32770' WindowName: ''
ClassName: '#32770' WindowName: '<Auxiliary name>'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK