Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner2.18731
Aggiunto al database dei virus Dr.Web:
2014-12-27
La descrizione è stata aggiunta:
2014-12-27
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = ''
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}] 'StubPath' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '18.exe' = '%APPDATA%Microsoft\System\Services\18.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18.exe' = '%APPDATA%Microsoft\System\Services\18.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = ''
Creates or modifies the following files:
%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Creates the following files on removable media:
<Drive name for removable media>:\RECYCLER\S-4-8-22-0407151415-0885180045-668684408-5603\DZFhdboo.cpl
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\RECYCLER\S-4-8-22-0407151415-0885180045-668684408-5603\fQDMJnKL.exe
Malicious functions:
Creates and executes the following:
'%APPDATA%\InstallDir\Server.exe'
'%ALLUSERSPROFILE%\Application Data\msconfigmgr.exe'
'%ALLUSERSPROFILE%\Application Data\msconfig.exe'
Executes the following:
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
%APPDATA%\Microsoft\Windows\((Mutex)).dat
%TEMP%\~TM2.tmp
%PROGRAM_FILES%\Internet Explorer\dmlconf.dat
%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe
%TEMP%\~TM1.tmp
%APPDATA%Microsoft\System\Services\18.exe
%ALLUSERSPROFILE%\Application Data\msconfig.exe
%ALLUSERSPROFILE%\Application Data\msconfigmgr.exe
%APPDATA%\InstallDir\Server.exe
%APPDATA%\Microsoft\Windows\((Mutex)).cfg
Sets the 'hidden' attribute to the following files:
%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
%APPDATA%\Microsoft\Windows\((Mutex)).dat
%APPDATA%\Microsoft\Windows\((Mutex)).cfg
Deletes the following files:
%APPDATA%\Microsoft\Windows\((Mutex)).cfg
%TEMP%\~TM2.tmp
%TEMP%\~TM1.tmp
Network activity:
Connects to:
'localhost':1093
'localhost':1092
'localhost':1095
'localhost':1094
'localhost':1080
'localhost':1067
'localhost':1066
'localhost':1079
'localhost':1068
'localhost':1097
'localhost':1133
'localhost':1132
'localhost':1135
'localhost':1134
'localhost':1131
'localhost':1099
'localhost':1098
'localhost':1130
'localhost':1127
'localhost':1045
'localhost':1044
'localhost':1047
'st###oliks.com':443
'localhost':1041
'localhost':1038
'localhost':1037
'localhost':1040
'localhost':1039
'74.##5.232.51':80
'localhost':1061
'localhost':1059
'localhost':1065
'localhost':1064
'localhost':1058
'localhost':81
'localhost':1049
'localhost':1057
'localhost':1055
UDP:
DNS ASK pr###liks.com
DNS ASK google.com
DNS ASK st###oliks.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK