Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Facebook.2447
Added to the Dr.Web virus database:
2013-12-03
Virus description added:
2013-12-03
Technical Information
To ensure autorun and distribution:
Creates the following services:
[<HKLM>\SYSTEM\ControlSet001\Services\vmx64o] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\w83c600] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
'<Full path to virus>.exe' --krasnoglaziki
Executes the following:
'<SYSTEM32>\sc.exe' start "w83c600"
'<SYSTEM32>\reg.exe' adD "hklm\SOfTwaRe\mIcrOSoFt\WiNdoWs nt\CURrENtveRSiOn\svcHoSt" /v vmapisvc /t rEg_mULti_sz /d "w83c600\0" /f
'<SYSTEM32>\reg.exe' adD "hkLm\sYsTEm\CuRrenTcoNtRoLSeT\seRvIcES\w83c600" /v FailureActions /t rEG_BInaRY /d 00000000000000000000000003000000140000000100000060EA00000100000060EA00000100000060EA0000 /f
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\sc.exe' boot ok
'<SYSTEM32>\svchost.exe' -k vmapisvc
'<SYSTEM32>\reg.exe' adD "hkLm\sYsTEm\CuRrenTcoNtRoLSeT\seRvIcES\w83c600\Parameters" /v ServiceDll /t ReG_EXpaND_Sz /d "<SYSTEM32>\cfgormd.dll" /f
'<SYSTEM32>\reg.exe' aDd "hklm\SOFTWARE\Microsoft\Internet Explorer\Main" /v TP /t ReG_Sz /d "1000" /f
'<SYSTEM32>\cmd.exe' /c "%TEMP%\sbatdel.bat"
'<SYSTEM32>\cmd.exe' /c ""<Full path to virus>.exe" --krasnoglaziki > "%TEMP%\sbatdel.bat""
'<SYSTEM32>\sc.exe' CreATe "w83c600" tyPE= share start= auto binPaTh= "<SYSTEM32>\svchost.exe -k vmapisvc" DisplayName= "HID Microsoft CompressedFolder Channel Parallel CPL sharing Download"
'<SYSTEM32>\netsh.exe' fIrEwaLl aDD pOrToPEnIng tcP 8085 "Abaqus Port" eNABLe
'<SYSTEM32>\netsh.exe' FIReWAlL Add allOweDPrOgrAm naMe="VMware NAT Configurator" prOGram="<SYSTEM32>\svchost.exe" mode=ENABLE
Modifies file system :
Creates the following files:
%TEMP%\sbatdel.bat
<DRIVERS>\haspsux.sys
<SYSTEM32>\cfgormd.dll
Deletes the following files:
Deletes itself.
Network activity:
Connects to:
'ze##iz.com':80
'localhost':8085
TCP:
HTTP GET requests:
ze##iz.com/v50/?v=#################################
UDP:
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK