Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner1.35432
Aggiunto al database dei virus Dr.Web:
2013-04-22
La descrizione è stata aggiunta:
2013-04-30
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'smss.exe' = '%WINDIR%\system\smss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\smss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\alg.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'alg.exe' = '%WINDIR%\system\alg.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\explorer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%WINDIR%\system\explorer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%WINDIR%\system\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'csrss.exe' = '%WINDIR%\system\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winguard.exe' = '<Current directory>\%ALLUSERSPROFILE%\Start Menu\Programs\Startup\winguard.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe C:\Users\All Users\Desktop\winguard.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %ALLUSERSPROFILE%\Start Menu\Programs\Startup\winguard.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %ALLUSERSPROFILE%\Start Menu\Programs\Startup\sysupdater.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sysupdater.exe' = '<Current directory>\%ALLUSERSPROFILE%\Start Menu\Programs\Startup\sysupdater.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost.exe' = '%WINDIR%\system\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wingui.exe' = '%WINDIR%\system\wingui.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winguard.exe' = '<Current directory>\C:\Users\All Users\Desktop\winguard.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe %WINDIR%\system\wingui.exe'
Creates or modifies the following files:
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\winguard.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\sysupdater.exe
Creates the following files on removable media:
<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\zombiepuzzle_DMD_PiDel.exe
<Drive name for removable media>:\zombiepuzzle_DMD_PiDel\zombiepuzzle_DMD_PiDel.exe
Malicious functions:
Executes the following:
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerD.bat
'<SYSTEM32>\attrib.exe' N:\*.* -s -h -r -a /s /d
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerF.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerE.bat
'<SYSTEM32>\attrib.exe' K:\*.* -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' J:\*.* -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' M:\*.* -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' L:\*.* -s -h -r -a /s /d
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerL.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerK.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerN.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerM.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerH.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerG.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerJ.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\scannerI.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterN.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterI.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterH.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterJ.bat
'<SYSTEM32>\attrib.exe' E:\*.* -s -h -r -a /s /d
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterE.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterD.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterG.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterF.bat
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterM.bat
'<SYSTEM32>\attrib.exe' F:\*.* -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' I:\*.* -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' H:\*.* -s -h -r -a /s /d
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterK.bat
'<SYSTEM32>\attrib.exe' <Drive name for removable media>:\*.* -s -h -r -a /s /d
'<SYSTEM32>\cmd.exe' /c %WINDIR%\system\updaterL.bat
'<SYSTEM32>\attrib.exe' G:\*.* -s -h -r -a /s /d
Modifies file system :
Creates the following files:
%WINDIR%\system\scannerL.bat
%WINDIR%\system\scannerM.bat
%WINDIR%\system\scannerN.bat
%WINDIR%\system\scannerK.bat
%WINDIR%\system\scannerH.bat
%WINDIR%\system\scannerI.bat
%WINDIR%\system\scannerJ.bat
%WINDIR%\system\csrss.exe
%WINDIR%\system\ctfmon.exe
%WINDIR%\system\explorer.exe
%WINDIR%\system\smss.exe
%WINDIR%\system\wingui.exe
%WINDIR%\system\svchost.exe
%WINDIR%\system\alg.exe
%WINDIR%\system\scannerG.bat
%WINDIR%\system\updaterH.bat
%WINDIR%\system\updaterI.bat
%WINDIR%\system\updaterJ.bat
%WINDIR%\system\updaterG.bat
%WINDIR%\system\updaterD.bat
%WINDIR%\system\updaterE.bat
%WINDIR%\system\updaterF.bat
%WINDIR%\system\scannerD.bat
%WINDIR%\system\scannerE.bat
%WINDIR%\system\scannerF.bat
%WINDIR%\system\updaterN.bat
%WINDIR%\system\updaterK.bat
%WINDIR%\system\updaterL.bat
%WINDIR%\system\updaterM.bat
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK