Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Win32.HLLW.Autoruner2.24498
Added to the Dr.Web virus database:
2016-06-20
Virus description added:
2016-06-20
Technical Information
Malicious functions:
Creates and executes the following:
'%APPDATA%\DriverDetective.exe'
Executes the following:
'<SYSTEM32>\msiexec.exe' -Embedding 34AE15ADDBA5D72292A7F142C933173C C
'<SYSTEM32>\msiexec.exe' /V
Searches for registry branches where third party applications store passwords:
[<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
Modifies file system:
Creates the following files:
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
%TEMP%\isprba3e.rra
%TEMP%\b721.rra
%TEMP%\MSI3.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isconfig.xml
<LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\0x0409.ini
<LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Driver Detective.msi
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Driver Detective.msi
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\ISSetup.dll
<LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Setup.INI
<LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\setup.isn
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Splash.bmp
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\_ISMSIDEL.INI
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Setup.INI
%APPDATA%\DriverDetective.exe
%TEMP%\~1.tmp
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\setup.isn
%TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\0x0409.ini
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isuser.dll
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\String1033.txt
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isres.dll
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\DialogBitmap.bmp
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\EULA.rtf
%TEMP%\MSI2.tmp
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.exe
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
%APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\ISRT.dll
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.inx
%APPDATA%\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
Deletes the following files:
%TEMP%\MSI3.tmp
%TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
%TEMP%\~1.tmp
%TEMP%\MSI2.tmp
Network activity:
Connects to:
'cs######4-crl.verisign.com':80
'crl.verisign.com':80
'wp#d':80
TCP:
HTTP GET requests:
http://CS######4-crl.verisign.com/CSC3-2004.crl via cs######4-crl.verisign.com
http://crl.verisign.com/pca3.crl
http://11#.#11.111.1/wpad.dat via wp#d
UDP:
DNS ASK cs######4-crl.verisign.com
DNS ASK crl.verisign.com
DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK