Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner3.2098
Added to the Dr.Web virus database:
2020-03-20
Virus description added:
2020-03-25
Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
[<HKCU>\Software\LinasFTP\Site Manager]
[<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\mIRC]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\VanDyke\SecureFX]
[<HKLM>\Software\NCH Software\Fling\Accounts]
[<HKCU>\Software\NCH Software\Fling\Accounts]
[<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\SimonTatham\PuTTY\Sessions]
[<HKLM>\Software\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Martin Prikryl]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Reads files which store third party applications passwords
%LOCALAPPDATA%\chromium\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\869fe8\8d252e.hdb
%APPDATA%\869fe8\8d252e.lck
Deletes the following files
%APPDATA%\869fe8\8d252e.lck
Substitutes the following files
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2922372159-162323534-3872807762-1001\f58155b4b1d5a524ca0261c3ee99fb50_597d9903-ea81-40e6-803a-40d3e5258fa4
Moves itself
from <Full path to file> to %APPDATA%\869fe8\8d252e.exe
Network activity
Connects to
TCP
HTTP POST requests
http://eu###ach.com/cream/five/fre.php
UDP
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK