Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Win32.HLLW.Autoruner1.30182

Added to the Dr.Web virus database: 2012-11-22

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\%USERNAME%.exe'
Creates the following files on removable media:
  • <Drive name for removable media>:\msvbvm60.dll
  • <Drive name for removable media>:\Punya %USERNAME%.exe
  • <Drive name for removable media>:\FFE.exe
  • <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
  • System Restore (SR)
  • Windows Security Center
Terminates or attempts to terminate
the following user processes:
  • AVP.EXE
  • nod32.exe
  • AVP32.EXE
  • avgcc.exe
  • ashAvast.exe
  • AVPM.EXE
Modifies file system :
Creates the following files:
  • <SYSTEM32>\ set.com
  • %WINDIR%\%USERNAME%.exe
  • C:\baca euy.txt
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\msvbvm60.dll
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\FFE.exe
Miscellaneous:
Searches for the following windows:
  • ClassName: 'ThunderRT6ComboBox' WindowName: ''
  • ClassName: 'ThunderRT6ListBox' WindowName: ''
  • ClassName: 'ThunderRT6FormDC' WindowName: ''
  • ClassName: 'ThunderRT6Frame' WindowName: ''