La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Win32.HLLW.Autoruner1.30182

Aggiunto al database dei virus Dr.Web: 2012-11-22

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\%USERNAME%.exe'
Creates the following files on removable media:
  • <Drive name for removable media>:\msvbvm60.dll
  • <Drive name for removable media>:\Punya %USERNAME%.exe
  • <Drive name for removable media>:\FFE.exe
  • <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
  • System Restore (SR)
  • Windows Security Center
Terminates or attempts to terminate
the following user processes:
  • AVP.EXE
  • nod32.exe
  • AVP32.EXE
  • avgcc.exe
  • ashAvast.exe
  • AVPM.EXE
Modifies file system :
Creates the following files:
  • <SYSTEM32>\ set.com
  • %WINDIR%\%USERNAME%.exe
  • C:\baca euy.txt
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\msvbvm60.dll
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\FFE.exe
Miscellaneous:
Searches for the following windows:
  • ClassName: 'ThunderRT6ComboBox' WindowName: ''
  • ClassName: 'ThunderRT6ListBox' WindowName: ''
  • ClassName: 'ThunderRT6FormDC' WindowName: ''
  • ClassName: 'ThunderRT6Frame' WindowName: ''