Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner1.45803
Added to the Dr.Web virus database:
2013-07-11
Virus description added:
2013-07-11
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'winlogon' = 'C:\heap41a\svchost.exe C:\heap41a\std.txt'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'status' = 'present'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
Creates and executes the following:
'C:\heap41a\svchost.exe' C:\heap41a\script1.txt
'C:\heap41a\svchost.exe' C:\heap41a\reproduce.txt
'%TEMP%\MicrosoftPowerPoint\svchost.exe' MicrosoftPowerPoint\install.txt
'C:\heap41a\svchost.exe' C:\heap41a\std.txt
Modifies file system :
Creates the following files:
C:\heap41a\Icon.ico
C:\heap41a\2.mp3
C:\heap41a\drivelist.txt
C:\heap41a\offspring\autorun.inf
C:\heap41a\script1.txt
C:\heap41a\std.txt
C:\heap41a\reproduce.txt
%TEMP%\MicrosoftPowerPoint\pathlist.txt
%TEMP%\MicrosoftPowerPoint\Install.txt
%TEMP%\MicrosoftPowerPoint\drivelist.txt
%TEMP%\MicrosoftPowerPoint\svchost.exe
C:\heap41a\svchost.exe
%TEMP%\MicrosoftPowerPoint\2.mp3
%TEMP%\MicrosoftPowerPoint\Icon.ico
Sets the 'hidden' attribute to the following files:
C:\heap41a\offspring\autorun.inf
Miscellaneous:
Searches for the following windows:
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\script1.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\reproduce.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\std.txt - AutoHotkey v1.0.46.08'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK