Win32.HLLW.Autoruner1.29619

Aggiunto al database dei virus Dr.Web: 2012-11-12

La descrizione è stata aggiunta: 2012-11-12

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmom' = '<SYSTEM32>\ctfmom.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GoogleUPdate' = '%WINDIR%\GoogleUPdate.exe'

Creates the following files on removable media:

Malicious functions:

Executes the following:

Modifies file system :

Creates the following files:

<SYSTEM32>\MSWINSCK.OCX
<SYSTEM32>\ctfmom.exe
<SYSTEM32>\autoupdate.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ocx[1].zip
%WINDIR%\config.bat
C:\win32cmd.bat
C:\autorun.inf
%WINDIR%\register.bat
<SYSTEM32>\Jpeg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\omt[1].zip
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\omw[1].zip
<SYSTEM32>\csrs.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\auto[1].zip
%WINDIR%\GoogleUPdate.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\csrs[1].zip

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: