Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner1.35899
Added to the Dr.Web virus database:
2013-04-29
Virus description added:
2013-05-04
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] 'windows help services' = '<SYSTEM32>\helpsrv.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dhcp client' = '%WINDIR%\dhcp.exe'
Creates the following files on removable media:
<Drive name for removable media>:\Girl.exe
<Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
hidden files
file extensions
blocks execution of the following system utilities:
Registry Editor (RegEdit)
Creates and executes the following:
'<SYSTEM32>\helpsrv.exe'
'%WINDIR%\dhcp.exe'
Executes the following:
'<SYSTEM32>\sc.exe' delete srservice
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop srservice
'<SYSTEM32>\sc.exe' stop sharedaccess
'<SYSTEM32>\sc.exe' delete sharedaccess
'<SYSTEM32>\cmd.exe' /c %TEMP%\_dhS.bat
'<SYSTEM32>\diskpart.exe' /s %TEMP%\hcdRS.dat
'<SYSTEM32>\sc.exe' delete avp
'<SYSTEM32>\sc.exe' delete wuauserv
'<SYSTEM32>\sc.exe' stop avp
'<SYSTEM32>\sc.exe' stop spooler
'<SYSTEM32>\sc.exe' start themes
'<SYSTEM32>\sc.exe' delete audiosrv
'<SYSTEM32>\cmd.exe' /c %TEMP%\_dSC.bat
'<SYSTEM32>\sc.exe' stop audiosrv
'<SYSTEM32>\sc.exe' stop wscsvc
'<SYSTEM32>\sc.exe' delete wscsvc
'<SYSTEM32>\sc.exe' delete sens
'<SYSTEM32>\sc.exe' delete spooler
'<SYSTEM32>\sc.exe' stop sens
Terminates or attempts to terminate
the following user processes:
Modifies settings of Windows Explorer:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'nosecuritytab' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'nosecuritytab' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'nofind' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'norun' = '00000001'
Modifies file system :
Creates the following files:
<SYSTEM32>\helpsrv.exe
<Current directory>\<Virus name>\Funny.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
<SYSTEM32>\directx.exe
<SYSTEM32>\igfx32.lrc
%WINDIR%\dhcp.exe
<SYSTEM32>\grouppolicy\machine\scripts\startup\ftdisk.exe
C:\autorun.inf
%TEMP%\sdlld2.dat
%TEMP%\sdlld3.dat
%TEMP%\_DLLd.bat
%TEMP%\sdlld1.dat
C:\Girl.exe
%TEMP%\hcdRS.dat
%TEMP%\_dhS.bat
%WINDIR%\Help\ipshelp.hlp
%WINDIR%\Temp\sync.adm
%WINDIR%\Temp\dradmin.adm
%WINDIR%\Temp\help.chm
%WINDIR%\Temp\explorer.adm
%TEMP%\_dSC.bat
%WINDIR%\Temp\user.adm
%WINDIR%\Temp\misc.dll
%WINDIR%\Temp\system.adm
<SYSTEM32>\dhcp.sys
<SYSTEM32>\ftdisk.sys
<SYSTEM32>\dpvsrv.dll
<SYSTEM32>\compmhelp.htm
%WINDIR%\Temp\host.ocx
<SYSTEM32>\initgdi32.cui
<SYSTEM32>\cmediahelp.chm
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\Girl.exe
%TEMP%\_dhS.bat
C:\Girl.exe
%TEMP%\_dSC.bat
<Current directory>\<Virus name>\Funny.exe
C:\autorun.inf
Miscellaneous:
Searches for the following windows:
ClassName: 'rebarwindow32' WindowName: ''
ClassName: 'workerw' WindowName: ''
ClassName: 'explorewclass' WindowName: ''
ClassName: 'comboboxex32' WindowName: ''
ClassName: 'cabinetwclass' WindowName: ''
ClassName: '' WindowName: 'windows task manager'
ClassName: '' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '#32770' WindowName: ''
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK