Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner2.28955
Added to the Dr.Web virus database:
2017-08-04
Virus description added:
2017-08-04
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
%WINDIR%\Tasks\UpdateService.job
Malicious functions:
Executes the following:
'<SYSTEM32>\schtasks.exe' /Run /TN "UpdateService"
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -t
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe'
'<SYSTEM32>\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe\" -t"
'%TEMP%\tmp28123\setup.exe' -i "<Full path to file>"
'%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -r "%TEMP%\tmp28123\setup.exe"
'<SYSTEM32>\schtasks.exe' /Delete /TN "UpdateService" /F
Modifies file system:
Creates the following files:
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\INE92X4H\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\8PA7WXIV\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KWI7JJRV\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\NetworkService\Cookies\index.dat
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\R837JOKF\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe
%TEMP%\tmp28123\setup.exe.config
%TEMP%\tmp28123\setup.exe
%ALLUSERSPROFILE%\Application Data\UpdateService\settings.dat
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\eb4d8809e0bad347cc11aa52d4a741e2_23ef5514-3059-436f-a4a7-4cefaab20eb1
%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe.config
Sets the 'hidden' attribute to the following files:
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\INE92X4H\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\R837JOKF\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KWI7JJRV\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\8PA7WXIV\desktop.ini
Deletes the following files:
%WINDIR%\Tasks\UpdateService.job
%TEMP%\tmp28123\setup.exe
Deletes itself.
Network activity:
Connects to:
'co##er66.hu':80
'po####klubimoy.ru':80
'wp#d':80
'xo##k.ru':80
TCP:
HTTP GET requests:
http://11#.#11.111.1/wpad.dat via wp#d
HTTP POST requests:
http://po####klubimoy.ru/admin/servis/sale/log.php?ur###############
http://co##er66.hu/plugins/system/logout/log.php?ur###############
http://xo##k.ru/libraries/cms/schema/changeitem/info.php?ur###############
UDP:
DNS ASK co##er66.hu
DNS ASK po####klubimoy.ru
DNS ASK wp#d
DNS ASK xo##k.ru
Miscellaneous:
Searches for the following windows:
ClassName: '' WindowName: 'Info32 Window - 015'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK