Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Win32.HLLW.Autoruner1.11777

Added to the Dr.Web virus database: 2012-02-11

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Studio 12' = '%PROGRAM_FILES%\Microsoft Studio\maker.exe'
Malicious functions:
Creates and executes the following:
  • %PROGRAM_FILES%\Microsoft Studio\maker.exe
Executes the following:
  • <SYSTEM32>\ping.exe 127.0.0.1
  • <SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\Microsoft Studio\delete.bat"
  • <SYSTEM32>\attrib.exe +h +s /d /s "%PROGRAM_FILES%\Microsoft Studio"
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\Microsoft Studio\mscr.exe
  • %PROGRAM_FILES%\Microsoft Studio\delete.bat
  • %PROGRAM_FILES%\Microsoft Studio\mlog.exe
  • %PROGRAM_FILES%\Microsoft Studio\maker.exe
  • %PROGRAM_FILES%\Microsoft Studio\log.txt
Deletes the following files:
  • %PROGRAM_FILES%\Microsoft Studio\mlog.exe
  • %PROGRAM_FILES%\Microsoft Studio\mscr.exe
  • %PROGRAM_FILES%\Microsoft Studio\log.txt
  • %PROGRAM_FILES%\Microsoft Studio\maker.exe