La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Win32.HLLW.Autoruner1.53432

Aggiunto al database dei virus Dr.Web: 2013-08-09

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\aec] 'ImagePath' = '<DRIVERS>\ybfg.sys'
  • [<HKLM>\SYSTEM\ControlSet001\Services\aec] 'ImagePath' = '<DRIVERS>\hjxd.sys'
  • [<HKLM>\SYSTEM\ControlSet001\Services\aec] 'ImagePath' = '<DRIVERS>\mfvu.sys'
Malicious functions:
Creates and executes the following:
  • '<SYSTEM32>\wuauolt.exe'
Modifies file system :
Creates the following files:
  • <DRIVERS>\hjxd.sys
  • %PROGRAM_FILES%\ybfg.sys
  • <DRIVERS>\ybfg.sys
  • %PROGRAM_FILES%\hjxd.sys
  • %PROGRAM_FILES%\mfvu.sys
  • <DRIVERS>\mfvu.sys
  • <SYSTEM32>\wuauolt.exe
Deletes the following files:
  • <DRIVERS>\hjxd.sys
  • %PROGRAM_FILES%\hjxd.sys
  • <DRIVERS>\mfvu.sys
  • %PROGRAM_FILES%\mfvu.sys
Miscellaneous:
Searches for the following windows:
  • ClassName: 'SysListView32' WindowName: '(null)'