Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Win32.HLLM.Limar.3418

Added to the Dr.Web virus database: 2010-03-19

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = ' wshentvd.dll'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Auxiliary name>] 'Startup' = 'WlxStartupEvent'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Auxiliary name>] 'DllName' = '<Full path to virus>'
Malicious functions:
Creates and executes the following:
  • '<SYSTEM32>\p2pnkbdl.exe'
Modifies file system :
Creates the following files:
  • <SYSTEM32>\powr3ivx.exe
  • <SYSTEM32>\pifmlpk.dll
  • <SYSTEM32>\p2pnkbdl.exe
  • <SYSTEM32>\wshentvd.dll