Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Win32.HLLW.Autoruner2.1819

Added to the Dr.Web virus database: 2014-01-06

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%APPDATA%\WindowsUpdate.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<Full path to virus>'
Creates the following files on removable media:
  • <Drive name for removable media>:\Sys.exe
  • <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
Creates and executes the following:
  • '%APPDATA%\Pin.exe'
  • '%TEMP%\service.exe'
Modifies file system :
Creates the following files:
  • %APPDATA%\WindowsUpdate.exe
  • %APPDATA%\pidloc.txt
  • %APPDATA%\Pin.exe
  • %TEMP%\34C0E.dmp
  • %TEMP%\dw.log
  • %TEMP%\service.exe
  • %TEMP%\aut1.tmp
  • %TEMP%\aut2.tmp
  • %APPDATA%\pid.txt
  • %TEMP%\ogrej.orh
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\Sys.exe
  • <Drive name for removable media>:\autorun.inf
Deletes the following files:
  • %TEMP%\aut2.tmp
  • %TEMP%\aut1.tmp
Network activity:
Connects to:
  • 'pa###bin.com':80
  • 'wp#d':80
  • 'ma##.######somachinesreviewsshop.com':25
TCP:
HTTP GET requests:
  • pa###bin.com/raw.php?i=########
  • wp#d/wpad.dat
UDP:
  • DNS ASK pa###bin.com
  • DNS ASK wp#d
  • DNS ASK ma##.######somachinesreviewsshop.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: '(null)'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'