Win32.HLLW.Autoruner2.16334

Aggiunto al database dei virus Dr.Web: 2014-07-23

La descrizione è stata aggiunta: 2014-07-23

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Wscript.vbs' = '<SYSTEM32>\wscript.exe /b "%TEMP%\Wscript.vbs"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Wscript.vbs' = '<SYSTEM32>\wscript.exe /b "%TEMP%\Wscript.vbs"'

Creates or modifies the following files:

Creates the following files on removable media:

Malicious functions:

Creates and executes the following:

'%TEMP%\system32..exe'
'%TEMP%\is-UDI6K.tmp\is-RHQH9.tmp' /SL4 $400DE "%HOMEPATH%\Local Settings\Tempskype.exe" 6123423 52736
'%HOMEPATH%\Local Settings\Tempskype.exe'

Executes the following:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
'<SYSTEM32>\mshta.exe'
'<SYSTEM32>\taskkill.exe' /f /im system32..exe
'<SYSTEM32>\wscript.exe' "%HOMEPATH%\Local Settings\TempWin8.vbs"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' "%TEMP%\system32..vb" /nowarn

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

Miscellaneous:

Searches for the following windows: