PARA USUARIOS

Mi biblioteca

+ Añadir a la biblioteca

Buscar

Soporte 24 horas | Normas de contactar

Escribir

una solicitud al rellenar un formulario

Llamar

+7 (495) 789-45-86

Foro

Sus solicitudes

Todas: -
No cerradas: -
Última: -

Crear una nueva solicitud

Llamar

+7 (495) 789-45-86

ES

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

Entrar en el analizador

Peritaje de IIV

Biblioteca de virus

Base de conocimiento

Tecnologías

Términos

Formación y educación

Mitos

Mitos sobre los antivirus

Win32.HLLW.Autoruner1.35391

Added to the Dr.Web virus database: 2013-04-20

Virus description added: 2013-04-29

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'File Service' = '"<SYSTEM32>\$sysvit64$\sysvit64.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'KIKW' = 'wscript /B /E:vbscript <SYSTEM32>\zbhvnby.cun /File Service'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Microsoft® Windows® Operating System' = '"<SYSTEM32>\$prefetch$\serivces.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft® Windows® Operating System' = '"<SYSTEM32>\$prefetch$\serivces.exe"'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\ytvr.rgi

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\$prefetch$\serivces.exe'
'<SYSTEM32>\$sysvit64$\sysvit64.exe'

Executes the following:

'<SYSTEM32>\attrib.exe' +H "E:\ytvr.rgi"
'<SYSTEM32>\attrib.exe' +H "E:\autorun.inf"
'<SYSTEM32>\attrib.exe' +H "Z:\autorun.inf"
'<SYSTEM32>\attrib.exe' -H "<SYSTEM32>\$sysvit64$\sysvit64.tmp"
'<SYSTEM32>\attrib.exe' +H "Z:\rwxe.ibl"
'<SYSTEM32>\attrib.exe' +H "<SYSTEM32>\$sysvit64$\sysvit64.ocx"
'<SYSTEM32>\attrib.exe' +H "<SYSTEM32>\$prefetch$\serivces.exe"
'<SYSTEM32>\attrib.exe' -H "<SYSTEM32>\$prefetch$\serivces.exe"
'<SYSTEM32>\attrib.exe' -H "<SYSTEM32>\$sysvit64$\sysvit64.exe"
'<SYSTEM32>\attrib.exe' +H "<SYSTEM32>\$sysvit64$\sysvit64.exe"
'<SYSTEM32>\attrib.exe' -H "<SYSTEM32>\$sysvit64$\sysvit64.ocx"

Modifies file system :

Creates the following files:

<SYSTEM32>\$prefetch$\serivces.dll
<SYSTEM32>\zbhvnby.cun
<SYSTEM32>\$sysvit64$\sysvit64.tmp
<SYSTEM32>\$prefetch$\serivces.exe
<SYSTEM32>\$sysvit64$\sysvit64.exe
<SYSTEM32>\$sysvit64$\sysvit64.ocx

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\ytvr.rgi
<SYSTEM32>\$sysvit64$\sysvit64.ocx
<SYSTEM32>\$prefetch$\serivces.exe
<SYSTEM32>\$sysvit64$\sysvit64.exe

Deletes the following files:

<SYSTEM32>\$sysvit64$\sysvit64.tmp

Modifies the HOSTS file.