La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Win32.HLLW.Autoruner2.19828

Aggiunto al database dei virus Dr.Web: 2015-03-26

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt64chain] 'Logon' = 'GetSimpleText'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt64chain] 'DLLName' = 'classapi64.dll'
Creates the following files on removable media:
  • <Drive name for removable media>:\RECYCLER\hmcmd.exe
  • <Drive name for removable media>:\AUTORUN.INF
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\system\svchost.exe' = '%WINDIR%\system\svchost.exe:*:enabled:Generic Host Process for Win32 Services'
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
Creates and executes the following:
  • '%WINDIR%\system\svchost.exe'
Executes the following:
  • '<SYSTEM32>\cmd.exe' /c <Virus name>.bat
Terminates or attempts to terminate
the following user processes:
  • iexplore.exe
  • opera.exe
  • firefox.exe
Modifies settings of Windows Internet Explorer:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:39002'
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome.css
  • <SYSTEM32>\opera6.ini
  • <Current directory>\<Virus name>.bat
  • <SYSTEM32>\classapi64.dll
  • <SYSTEM32>\mapitools.dll
  • %WINDIR%\system\svchost.exe
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\AUTORUN.INF
  • <Drive name for removable media>:\RECYCLER\hmcmd.exe
Deletes itself.
Network activity:
Connects to:
  • 'se###hparse.com':80
TCP:
HTTP GET requests:
  • http://11#.#11.111.1/dfHt6bd13/vars.php?si# via se###hparse.com
  • http://11#.#11.111.1/dfHtLD.exe via se###hparse.com
  • http://11#.#11.111.1/dfHt6bd13/dfHt6bd13 via se###hparse.com
UDP:
  • DNS ASK se###hparse.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_WINHELP' WindowName: ''