Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner1.53181
Aggiunto al database dei virus Dr.Web:
2013-08-08
La descrizione è stata aggiunta:
2013-08-08
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bdv' = 'C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\bdv.exe'
Creates the following files on removable media:
<Drive name for removable media>:\aUtoRuN.inF
Malicious functions:
Executes the following:
'<SYSTEM32>\attrib.exe' nul /f /c if exist j:\nul attrib +s +h +r +a j:\Photos\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist v:\nul attrib +s +h +r +a v:\Audio\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist l:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* l:\ /h /k /c /e /y
'<SYSTEM32>\xcopy.exe' C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* e:\ /h /k /c /e /y
'<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\Videoc~1\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist r:\nul attrib +s +h +r +a r:\Videoc~1\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Audio\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist u:\nul attrib +s +h +r +a u:\Videoc~1\*.*
'<SYSTEM32>\xcopy.exe' nul /f /c if exist <Drive name for removable media>:\nul attrib +s +h +r +a <Drive name for removable media>:\Videoc~1\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\MyMusi~1
'<SYSTEM32>\attrib.exe' nul /f /c if exist h:\nul attrib +s +h +r +a h:\Audio\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Videoc~1\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist o:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* o:\ /h /k /c /e /y
'<SYSTEM32>\attrib.exe' nul /f /c if exist n:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* n:\ /h /k /c /e /y
'<SYSTEM32>\attrib.exe' nul /f /c if exist l:\nul attrib +s +h +r +a l:\MyMusi~1
'<SYSTEM32>\attrib.exe' nul /f /c if exist r:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* r:\ /h /k /c /e /y
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\MyMusi~1\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\MyMusi~1
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Videos\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Video\*.*
'<SYSTEM32>\xcopy.exe' BDV.exe C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\ /h /k /y
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\BDv.bat" "
'<SYSTEM32>\attrib.exe' +s +h +r +a C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.*
'<SYSTEM32>\wscript.exe' "C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\bdv.vbs"
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Mp3\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist h:\nul attrib +s +h +r +a h:\Sounds\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\Received\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Received\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Sounds\*.*
'<SYSTEM32>\attrib.exe' +s +h +r +a e:\Music\*.*
'<SYSTEM32>\attrib.exe' nul /f /c if exist g:\nul attrib +s +h +r +a g:\Sounds\*.*
'<SYSTEM32>\wscript.exe' /pid=2832
Injects code into
the following system processes:
<SYSTEM32>\attrib.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\cmd.exe
Modifies file system :
Creates the following files:
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\aUtoRuN.inF
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\bdv.vbs
%TEMP%\1.tmp\BDv.bat
Sets the 'hidden' attribute to the following files:
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\aUtoRuN.inF
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK