Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner1.12259
Added to the Dr.Web virus database:
2012-02-20
Virus description added:
2012-03-12
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctstray.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsgui.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.EXE] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\svchost.com'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\fdisk.com'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%TEMP%\svchost.com'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'User Agent' = '%TEMP%\svchost.com'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe <SYSTEM32>\fdisk.com'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User Agent' = '<SYSTEM32>\fdisk.com'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HotKey' = '%HOMEPATH%\Templates\cache\SFCsrvc.pif'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HotKey' = '%HOMEPATH%\Templates\cache\SFCsrvc.pif'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBGUARD.EXE] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
[<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"%WINDIR%\Help\cliconf.chm"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = '%TEMP%\svchost.com Kll_dis'
Creates or modifies the following files:
%HOMEPATH%\Start Menu\Programs\Startup\sndvol32.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\sndvol32.exe
Creates the following files on removable media:
<Drive name for removable media>:\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\desktop.ini
<Drive name for removable media>:\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\temp.db
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\Thumbs.db
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
hidden files
file extensions
blocks execution of the following system utilities:
Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)
Creates and executes the following:
%CommonProgramFiles%\System\cftmon.exe stay_alive -r
%TEMP%\svchost.com keep_fucking
%TEMP%\svchost.com
%CommonProgramFiles%\System\cftmon.exe stay_alive -in
Terminates or attempts to terminate
the following user processes:
Modifies settings of Windows Explorer:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NofolderOptions' = '00000001'
Modifies file system :
Creates the following files:
C:\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\desktop.ini
C:\Thumbs.db
C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cartman[1].php
%HOMEPATH%\Templates\cache\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\temp.db
C:\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\temp.db
%TEMP%\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\temp.db
%CommonProgramFiles%\System\cftmon.exe
%HOMEPATH%\Templates\cache\SFCsrvc.pif
%TEMP%\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\desktop.ini
%TEMP%\svchost.com
%HOMEPATH%\Templates\cache\$RECYCLE.BIN\{5F229C11-5039-40E4-8537-6950BB1C9ECC}\desktop.ini
%WINDIR%\Help\cliconf.chm
<SYSTEM32>\fdisk.com
%HOMEPATH%\Templates\cache\desktop.ini
Sets the 'hidden' attribute to the following files:
C:\Thumbs.db
C:\autorun.inf
<Drive name for removable media>:\Thumbs.db
<Drive name for removable media>:\autorun.inf
%HOMEPATH%\Start Menu\Programs\Startup\sndvol32.exe
%HOMEPATH%\Templates\cache\SFCsrvc.pif
%TEMP%\svchost.com
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\sndvol32.exe
<SYSTEM32>\fdisk.com
Network activity:
Connects to:
'ne#####m.dyndns.info':80
'i4#.#inypic.com':80
TCP:
HTTP GET requests:
ne#####m.dyndns.info/cartman.php
i4#.#inypic.com/got07s.jpg
UDP:
DNS ASK i4#.#inypic.com
DNS ASK ne#####m.dyndns.info
DNS ASK pr###.just.edu.jo
'<Private IP address>':1035
Miscellaneous:
Searches for the following windows:
ClassName: 'Indicator' WindowName: ''
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK