PARA USUARIOS

Mi biblioteca

+ Añadir a la biblioteca

Buscar

Soporte 24 horas | Normas de contactar

Escribir

una solicitud al rellenar un formulario

Llamar

+7 (495) 789-45-86

Foro

Sus solicitudes

Todas: -
No cerradas: -
Última: -

Crear una nueva solicitud

Llamar

+7 (495) 789-45-86

ES

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

Entrar en el analizador

Peritaje de IIV

Biblioteca de virus

Base de conocimiento

Tecnologías

Términos

Formación y educación

Mitos

Mitos sobre los antivirus

Win32.HLLO.Blop.157

Added to the Dr.Web virus database: 2012-08-19

Virus description added: 2012-09-09

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\04QVMOAC0CH] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\YGB1XO2D] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\UCBDB4C.exe rb
%PROGRAM_FILES%\UCBDB4C.exe <Full path to virus>

Executes the following:

<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
<SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
<SYSTEM32>\regsvr32.exe /u /s shimgvw.dll
<SYSTEM32>\sc.exe create 04QVMOAC0CH BinPath= "%PROGRAM_FILES%\WHBD6Q\MNPNCPU.EXE -VXYKE1H9JQ" type= own type= interact start= auto DisplayName= 06RHN
<SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\OPWVFPTLGV0.bat"
<SYSTEM32>\regsvr32.exe /u /s itss.dll
<SYSTEM32>\regsvr32.exe /s jscript.dll
<SYSTEM32>\regsvr32.exe /u /s vbscript.dll
<SYSTEM32>\regsvr32.exe /u /s scrrun.dll

Modifies file system :

Creates the following files:

%WINDIR%\HDBC9I8.exe
%TEMP%\RGI1.tmp
%PROGRAM_FILES%\OPWVFPTLGV0.bat
%PROGRAM_FILES%\UCBDB4C.exe
%PROGRAM_FILES%\WHBD6Q\MNPNCPU.EXE

Sets the 'hidden' attribute to the following files:

<Full path to virus>

Deletes the following files:

%TEMP%\RGI1.tmp

Network activity:

Connects to:

'58.#9.58.27':443

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'easyclickplus3' WindowName: ''
ClassName: 'VNGUPYFKZTIOS' WindowName: 'galuahjuiryrty'