Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner1.45803
Aggiunto al database dei virus Dr.Web:
2013-07-11
La descrizione è stata aggiunta:
2013-07-11
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'winlogon' = 'C:\heap41a\svchost.exe C:\heap41a\std.txt'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'status' = 'present'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
Creates and executes the following:
'C:\heap41a\svchost.exe' C:\heap41a\script1.txt
'C:\heap41a\svchost.exe' C:\heap41a\reproduce.txt
'%TEMP%\MicrosoftPowerPoint\svchost.exe' MicrosoftPowerPoint\install.txt
'C:\heap41a\svchost.exe' C:\heap41a\std.txt
Modifies file system :
Creates the following files:
C:\heap41a\Icon.ico
C:\heap41a\2.mp3
C:\heap41a\drivelist.txt
C:\heap41a\offspring\autorun.inf
C:\heap41a\script1.txt
C:\heap41a\std.txt
C:\heap41a\reproduce.txt
%TEMP%\MicrosoftPowerPoint\pathlist.txt
%TEMP%\MicrosoftPowerPoint\Install.txt
%TEMP%\MicrosoftPowerPoint\drivelist.txt
%TEMP%\MicrosoftPowerPoint\svchost.exe
C:\heap41a\svchost.exe
%TEMP%\MicrosoftPowerPoint\2.mp3
%TEMP%\MicrosoftPowerPoint\Icon.ico
Sets the 'hidden' attribute to the following files:
C:\heap41a\offspring\autorun.inf
Miscellaneous:
Searches for the following windows:
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\script1.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\reproduce.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\std.txt - AutoHotkey v1.0.46.08'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK