Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner2.5847
Added to the Dr.Web virus database:
2014-02-07
Virus description added:
2014-02-08
Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
<Drive name for removable media>:\Autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
Windows Task Manager (Taskmgr)
Executes the following:
'<SYSTEM32>\attrib.exe' /pid=3068
'<SYSTEM32>\attrib.exe' /pid=3092
'<SYSTEM32>\attrib.exe' /pid=3052
'<SYSTEM32>\attrib.exe' /pid=3020
'<SYSTEM32>\attrib.exe' /pid=3028
'<SYSTEM32>\attrib.exe' /pid=3236
'<SYSTEM32>\attrib.exe' /pid=3248
'<SYSTEM32>\attrib.exe' /pid=3856
'<SYSTEM32>\attrib.exe' /pid=3408
'<SYSTEM32>\attrib.exe' /pid=3424
'<SYSTEM32>\attrib.exe' /pid=1148
'<SYSTEM32>\attrib.exe' +r +a +s +h x:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h y:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h w:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h u:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h v:\ghandil.exe
'<SYSTEM32>\attrib.exe' /pid=2932
'<SYSTEM32>\attrib.exe' /pid=2956
'<SYSTEM32>\attrib.exe' /pid=2920
'<SYSTEM32>\attrib.exe' +r +a +s +h z:\ghandil.exe
'<SYSTEM32>\attrib.exe' /pid=1728
'<SYSTEM32>\attrib.exe' /pid=3268
'<SYSTEM32>\attrib.exe' /pid=3656
'<SYSTEM32>\attrib.exe' /pid=4056
'<SYSTEM32>\attrib.exe' /pid=3760
'<SYSTEM32>\attrib.exe' /pid=3172
'<SYSTEM32>\attrib.exe' /pid=3852
'<SYSTEM32>\attrib.exe' /pid=2468
'<SYSTEM32>\attrib.exe' /pid=2492
'<SYSTEM32>\attrib.exe' /pid=2452
'<SYSTEM32>\attrib.exe' /pid=292
'<SYSTEM32>\attrib.exe' /pid=288
'<SYSTEM32>\attrib.exe' /pid=3140
'<SYSTEM32>\attrib.exe' /pid=3984
'<SYSTEM32>\attrib.exe' /pid=4024
'<SYSTEM32>\attrib.exe' /pid=3888
'<SYSTEM32>\attrib.exe' /pid=3324
'<SYSTEM32>\attrib.exe' /pid=3352
'<SYSTEM32>\attrib.exe' /pid=2996
'<SYSTEM32>\attrib.exe' /pid=3116
'<SYSTEM32>\attrib.exe' /pid=2696
'<SYSTEM32>\attrib.exe' /pid=4032
'<SYSTEM32>\attrib.exe' /pid=4048
'<SYSTEM32>\attrib.exe' +r +a +s +h t:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h p:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h q:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h o:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h m:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h n:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h u:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h v:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h t:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h r:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h s:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h l:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h e:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h f:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h <Drive name for removable media>:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h b:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h c:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h j:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h k:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h i:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h g:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h h:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h w:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h m:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h n:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h l:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h j:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h k:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h r:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h s:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h q:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h o:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h p:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h i:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h b:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h c:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h z:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h x:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h y:\Autorun.inf
'<SYSTEM32>\attrib.exe' +r +a +s +h g:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h h:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h f:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h <Drive name for removable media>:\ghandil.exe
'<SYSTEM32>\attrib.exe' +r +a +s +h e:\ghandil.exe
Injects code into
the following system processes:
Modifies file system :
Creates the following files:
C:\Autorun.inf
<SYSTEM32>\Autorun.inf
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\Autorun.inf
C:\Autorun.inf
Miscellaneous:
Searches for the following windows:
ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: '(null)' WindowName: 'System Configuration Utility'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK