Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner.7317
Aggiunto al database dei virus Dr.Web:
2009-07-28
La descrizione è stata aggiunta:
2013-10-11
Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\usbhelp.exe
Malicious functions:
Creates and executes the following:
'%TEMP%\57812.exe'
'%TEMP%\24175.exe'
'%TEMP%\36187.exe'
'%TEMP%\82180.exe'
'%TEMP%\56133.exe'
'%TEMP%\34041.exe'
'%TEMP%\74654.exe'
'%TEMP%\73562.exe'
'%TEMP%\86745.exe'
'%TEMP%\68304.exe'
'%TEMP%\86242.exe'
'%TEMP%\7772.exe'
'%TEMP%\50768.exe'
'%TEMP%\32207.exe'
'%TEMP%\76787.exe'
'%TEMP%\74654.exe' (downloaded from the Internet)
'%TEMP%\86242.exe' (downloaded from the Internet)
'%TEMP%\68304.exe' (downloaded from the Internet)
'%TEMP%\34041.exe' (downloaded from the Internet)
'%TEMP%\76787.exe' (downloaded from the Internet)
'%TEMP%\73562.exe' (downloaded from the Internet)
'%TEMP%\86745.exe' (downloaded from the Internet)
'%TEMP%\56133.exe' (downloaded from the Internet)
'%TEMP%\7772.exe' (downloaded from the Internet)
'%TEMP%\50768.exe' (downloaded from the Internet)
'%TEMP%\82180.exe' (downloaded from the Internet)
'%TEMP%\32207.exe' (downloaded from the Internet)
'%TEMP%\24175.exe' (downloaded from the Internet)
'%TEMP%\36187.exe' (downloaded from the Internet)
'%TEMP%\57812.exe' (downloaded from the Internet)
Injects code into
the following system processes:
Modifies file system :
Creates the following files:
%TEMP%\24175.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\11[1].ico
%TEMP%\86745.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\10[1].ico
%TEMP%\36187.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\9[1].ico
%TEMP%\57812.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\12[1].ico
%TEMP%\34041.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\15[1].ico
%TEMP%\74654.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\14[1].ico
%TEMP%\68304.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\13[1].ico
%TEMP%\73562.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\8[1].ico
%TEMP%\86242.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\3[1].ico
%TEMP%\32207.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2[1].ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\usb[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].ico
%TEMP%\76787.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\4[1].ico
%TEMP%\82180.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\7[1].ico
%TEMP%\56133.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\6[1].ico
%TEMP%\7772.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5[1].ico
%TEMP%\50768.exe
Network activity:
Connects to:
TCP:
HTTP GET requests:
ma####rents.info/payloads/10.ico
ma####rents.info/payloads/11.ico
ma####rents.info/payloads/8.ico
ma####rents.info/payloads/9.ico
ma####rents.info/payloads/14.ico
ma####rents.info/payloads/15.ico
ma####rents.info/payloads/12.ico
ma####rents.info/payloads/13.ico
ma####rents.info/payloads/2.ico
ma####rents.info/payloads/3.ico
ma####rents.info/usb.php?ms#########################
ma####rents.info/payloads/1.ico
ma####rents.info/payloads/6.ico
ma####rents.info/payloads/7.ico
ma####rents.info/payloads/4.ico
ma####rents.info/payloads/5.ico
UDP:
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK