Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLM.Reset.481
Aggiunto al database dei virus Dr.Web:
2015-09-20
La descrizione è stata aggiunta:
2017-11-18
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\jwaroevi\rarexsdb.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RarExsdb' = '<LS_APPDATA>\jwaroevi\rarexsdb.exe'
Creates or modifies the following files:
%HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
Windows Update
Windows Security Center
blocks the following features:
User Account Control (UAC)
Windows Security Center
Creates and executes the following:
Executes the following:
Injects code into
the following system processes:
Modifies file system:
Creates the following files:
<LS_APPDATA>\jwaroevi\rarexsdb.exe
%TEMP%\ifqydaby.exe
<LS_APPDATA>\lawhwilb.log
%ALLUSERSPROFILE%\Application Data\ybfcuwpc.log
%TEMP%\~DF683C.tmp
%TEMP%\~DF5294.tmp
%TEMP%\~DF522A.tmp
%TEMP%\~DF67CA.tmp
%TEMP%\byjjjqlf.exe
Sets the 'hidden' attribute to the following files:
%HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Network activity:
Connects to:
'jr###tpwr.com':443
'wg#####ccyaebgdgn.com':443
'fx###xmrry.com':443
'ji###eoa.com':443
'aa#####dnhhidhwk.com':443
'vb#####dfbcvqgrfxa.com':443
'bu####slvjlmf.com':443
'ok####eu3017uhe.com':443
'74.##5.232.51':80
'si#####sqjuvlwif.com':443
'ly#####elikfigrbnxo.com':443
'wv####jaaorsi.com':443
UDP:
DNS ASK qa####igguti.com
DNS ASK tt###tosrtl.com
DNS ASK il#####yrctwwysk.com
DNS ASK ov#####ocsrqrtks.com
DNS ASK um###sufev.com
DNS ASK oh###igik.com
DNS ASK hp###cor.com
DNS ASK yo####humejfhm.com
DNS ASK pl###sethqb.com
DNS ASK xf###syao.com
DNS ASK xp###vtu.com
DNS ASK ko###fditlc.com
DNS ASK xk###lwxmy.com
DNS ASK lf###mphn.com
DNS ASK ri###grqrod.com
DNS ASK ms#####wrtmjjjrgeew.com
DNS ASK bing.com
DNS ASK at###tvaqr.com
DNS ASK gy####yrhwyugui.com
DNS ASK jf####lnipoo.com
DNS ASK fq#####dkdmjjfceuf.com
DNS ASK uv###iuphhf.com
DNS ASK ry###vevpka.com
DNS ASK fu#####emwdbmsmcx.com
DNS ASK hw###ogofk.com
DNS ASK hk####tomfuev.com
DNS ASK mk###umsg.com
DNS ASK vb#####dfbcvqgrfxa.com
DNS ASK jr###tpwr.com
DNS ASK wg#####ccyaebgdgn.com
DNS ASK xo####silknsdub.com
DNS ASK ji###eoa.com
DNS ASK aa#####dnhhidhwk.com
DNS ASK fx###xmrry.com
DNS ASK bu####slvjlmf.com
DNS ASK ok####eu3017uhe.com
DNS ASK google.com
DNS ASK si#####sqjuvlwif.com
DNS ASK ly#####elikfigrbnxo.com
DNS ASK wv####jaaorsi.com
DNS ASK ns###idxuwb.com
DNS ASK xq####rtkdxdi.com
DNS ASK mx###fesqlk.com
DNS ASK ur#####ytfyiaaly.com
DNS ASK kt####drwbwpwwb.com
DNS ASK vq###cqpjj.com
DNS ASK qp#####qduvbkiusgba.com
DNS ASK rk####eyqjxwjh.com
DNS ASK if#####ujqprjwuwt.com
DNS ASK wq####qhvdwd.com
DNS ASK ye###hhcg.com
DNS ASK du#####gvkhcsmvioj.com
DNS ASK lp###dyw.com
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK