Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner1.4390
Added to the Dr.Web virus database:
2011-11-24
Virus description added:
2011-11-24
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Subsystem Server 7.20' = '<SYSTEM32>\config\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Session Manager Subsystem Server 3.91' = '<SYSTEM32>\config\smss.exe'
Creates the following files on removable media:
<Drive name for removable media>:\Folder.exe
<Drive name for removable media>:\autorun.inf
Malicious functions:
Creates and executes the following:
<SYSTEM32>\config\csrss.exe
<SYSTEM32>\config\smss.exe
%WINDIR%\Temp\hive.exe
Modifies file system :
Creates the following files:
<SYSTEM32>\config\csrss.exe
%WINDIR%\Help\OEM\fr-Fr\CRNURN11101150957PM.ini
C:\Sm9ssE2039.dat
%WINDIR%\Temp\hive.exe
Deletes the following files:
<SYSTEM32>\config\smss.exe
%TEMP%\~DFA6BF.tmp
C:\Sm9ssE2039.dat
%TEMP%\~DF9FE6.tmp
Miscellaneous:
Searches for the following windows:
ClassName: '' WindowName: 'Connections Tray'
ClassName: '' WindowName: 'Tiny H-Pot v1.6'
ClassName: '' WindowName: '<Auxiliary name>'
ClassName: '' WindowName: 'Show details for each &battery.'
ClassName: '' WindowName: 'Power Meter'
ClassName: '' WindowName: 'Power status'
ClassName: '' WindowName: '&Always show icon on the taskbar.'
ClassName: '' WindowName: 'Main'
ClassName: '' WindowName: '0 Sm9ssE2039 E smss.exe 893'
ClassName: '' WindowName: '0 Sm9ssE2039 E csrss.exe 893'
ClassName: '' WindowName: 'Life'
ClassName: '' WindowName: '<SYSTEM32>\cscript.exe'
ClassName: '' WindowName: '<Auxiliary name> - build Mar 22 2011'
ClassName: '' WindowName: 'CicMarshalWndAMK'
ClassName: '' WindowName: 'OleMainThreadWndName'
ClassName: '' WindowName: 'OLEChannelWnd'
ClassName: '' WindowName: 'Start'
ClassName: '' WindowName: 'CiceroUIWndFrame'
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
ClassName: '' WindowName: 'CicMarshalWndICG'
ClassName: '' WindowName: 'CicMarshalWndMHG'
ClassName: '' WindowName: 'CicMarshalWndIJF'
ClassName: '' WindowName: 'MS_WebcheckMonitor'
ClassName: '' WindowName: 'FolderView'
ClassName: '' WindowName: 'Notification Area'
ClassName: '' WindowName: 'Running Applications'
ClassName: '' WindowName: 'Program Manager'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK