La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Win32.HLLW.Autoruner1.46614

Aggiunto al database dei virus Dr.Web: 2013-07-17

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Process Adapter Shadow Manager' = '<SYSTEM32>\qqsmxpakr.exe'
Creates or modifies the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\qqsmxpakr.exe
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Key Parental Foundation Portable] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
  • Windows Security Center
Creates and executes the following:
  • '<SYSTEM32>\tnaxgbij.exe' "<SYSTEM32>\qqsmxpakr.exe"
  • '%WINDIR%\Temp\qegusdf5v5zdotsw.exe' -r 43020 tcp
  • '%TEMP%\qegusdf5lq5dotsfzoia1.exe'
  • '<SYSTEM32>\qqsmxpakr.exe'
Modifies file system :
Creates the following files:
  • <SYSTEM32>\alcyfyyzkybesj\run
  • <SYSTEM32>\alcyfyyzkybesj\rng
  • <SYSTEM32>\alcyfyyzkybesj\cfg
  • <SYSTEM32>\alcyfyyzkybesj\por
  • %WINDIR%\Temp\qegusdf5v5zdotsw.exe
  • %TEMP%\qegusdf5lq5dotsfzoia1.exe
  • <SYSTEM32>\alcyfyyzkybesj\tst
  • <SYSTEM32>\alcyfyyzkybesj\etc
  • <SYSTEM32>\tnaxgbij.exe
  • <SYSTEM32>\qqsmxpakr.exe
Sets the 'hidden' attribute to the following files:
  • <SYSTEM32>\tnaxgbij.exe
  • <SYSTEM32>\qqsmxpakr.exe
Deletes the following files:
  • %WINDIR%\Temp\qegusdf5v5zdotsw.exe
  • %TEMP%\qegusdf5lq5dotsfzoia1.exe
  • <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
  • 'fi###news.net':80
  • 'th###state.net':80
  • 'fi###mark.net':80
  • 'so###news.net':80
  • 'li###tate.net':80
  • 'th###mark.net':80
  • 'li###ark.net':80
  • 'th###broke.net':80
  • 'li###roke.net':80
  • 'so###mark.net':80
  • 'fa###teach.net':80
  • 'ri###rave.net':80
  • 'fa###could.net':80
  • 'ri###each.net':80
  • 'fa###grave.net':80
  • 'so###broke.net':80
  • 'fi###broke.net':80
  • 'so###state.net':80
  • 'fi###state.net':80
  • 'th###news.net':80
  • 'le###roke.net':80
  • 'ta###mark.net':80
  • 'le###tate.net':80
  • 'ta###broke.net':80
  • 'le###ark.net':80
  • 'po###state.net':80
  • 'ca###tate.net':80
  • 'ta###news.net':80
  • 'le###ews.net':80
  • 'ta###state.net':80
  • 'we###tate.net':80
  • 'fe###roke.net':80
  • 'li###ews.net':80
  • 'fe###tate.net':80
  • 'we###roke.net':80
  • 'fe###ews.net':80
  • 'we###ews.net':80
  • 'fe###ark.net':80
  • 'we###ark.net':80
  • 'ri###ould.net':80
  • 'we###each.net':80
  • 'fe###rave.net':80
  • 'we###ould.net':80
  • 'fe###each.net':80
  • 'we###rave.net':80
  • 'ta###could.net':80
  • 'le###ould.net':80
  • 'ta###usual.net':80
  • 'le###sual.net':80
  • 'fe###ould.net':80
  • 'ja###uter.com':80
  • 'go#####everytime.com':80
  • 'do####club-grup.com':80
  • 'el#####arimagine.com':80
  • 'li###each.net':80
  • 'fe###sual.net':80
  • 'we###sual.net':80
  • 'th###grave.net':80
  • 'li###rave.net':80
  • 'ta###teach.net':80
  • 'li###sual.net':80
  • 'no###ould.net':80
  • 'ca###rave.net':80
  • 'no###sual.net':80
  • 'li###ould.net':80
  • 'ri###sual.net':80
  • 'fa###usual.net':80
  • 'no###each.net':80
  • 'no###rave.net':80
  • 'po###grave.net':80
  • 'le###rave.net':80
  • 'po###usual.net':80
  • 'le###each.net':80
  • 'ta###grave.net':80
  • 'ca###sual.net':80
  • 'po###teach.net':80
  • 'ca###each.net':80
  • 'po###could.net':80
  • 'ca###ould.net':80
TCP:
HTTP GET requests:
  • fi###news.net/forum/search.php?me#########################################
  • th###state.net/forum/search.php?me#########################################
  • fi###mark.net/forum/search.php?me#########################################
  • so###news.net/forum/search.php?me#########################################
  • li###tate.net/forum/search.php?me#########################################
  • th###mark.net/forum/search.php?me#########################################
  • li###ark.net/forum/search.php?me#########################################
  • th###broke.net/forum/search.php?me#########################################
  • li###roke.net/forum/search.php?me#########################################
  • so###mark.net/forum/search.php?me#########################################
  • fa###teach.net/forum/search.php?me#########################################
  • ri###rave.net/forum/search.php?me#########################################
  • fa###could.net/forum/search.php?me#########################################
  • ri###each.net/forum/search.php?me#########################################
  • fa###grave.net/forum/search.php?me#########################################
  • so###broke.net/forum/search.php?me#########################################
  • fi###broke.net/forum/search.php?me#########################################
  • so###state.net/forum/search.php?me#########################################
  • fi###state.net/forum/search.php?me#########################################
  • th###news.net/forum/search.php?me#########################################
  • le###roke.net/forum/search.php?me#########################################
  • ta###mark.net/forum/search.php?me#########################################
  • le###tate.net/forum/search.php?me#########################################
  • ta###broke.net/forum/search.php?me#########################################
  • le###ark.net/forum/search.php?me#########################################
  • po###state.net/forum/search.php?me#########################################
  • ca###tate.net/forum/search.php?me#########################################
  • ta###news.net/forum/search.php?me#########################################
  • le###ews.net/forum/search.php?me#########################################
  • ta###state.net/forum/search.php?me#########################################
  • we###tate.net/forum/search.php?me#########################################
  • fe###roke.net/forum/search.php?me#########################################
  • li###ews.net/forum/search.php?me#########################################
  • fe###tate.net/forum/search.php?me#########################################
  • we###roke.net/forum/search.php?me#########################################
  • fe###ews.net/forum/search.php?me#########################################
  • we###ews.net/forum/search.php?me#########################################
  • fe###ark.net/forum/search.php?me#########################################
  • we###ark.net/forum/search.php?me#########################################
  • ri###ould.net/forum/search.php?me#########################################
  • we###each.net/forum/search.php?me#########################################
  • fe###rave.net/forum/search.php?me#########################################
  • we###ould.net/forum/search.php?me#########################################
  • fe###each.net/forum/search.php?me#########################################
  • we###rave.net/forum/search.php?me#########################################
  • ta###could.net/forum/search.php?me#########################################
  • le###ould.net/forum/search.php?me#########################################
  • ta###usual.net/forum/search.php?me#########################################
  • le###sual.net/forum/search.php?me#########################################
  • fe###ould.net/forum/search.php?me#########################################
  • ja###uter.com/forum/search.php?me#########################################
  • go#####everytime.com/forum/search.php?me#########################################
  • do####club-grup.com/forum/search.php?me#########################################
  • el#####arimagine.com/forum/search.php?me#########################################
  • li###each.net/forum/search.php?me#########################################
  • fe###sual.net/forum/search.php?me#########################################
  • we###sual.net/forum/search.php?me#########################################
  • th###grave.net/forum/search.php?me#########################################
  • li###rave.net/forum/search.php?me#########################################
  • ta###teach.net/forum/search.php?me#########################################
  • li###sual.net/forum/search.php?me#########################################
  • no###ould.net/forum/search.php?me#########################################
  • ca###rave.net/forum/search.php?me#########################################
  • no###sual.net/forum/search.php?me#########################################
  • li###ould.net/forum/search.php?me#########################################
  • ri###sual.net/forum/search.php?me#########################################
  • fa###usual.net/forum/search.php?me#########################################
  • no###each.net/forum/search.php?me#########################################
  • no###rave.net/forum/search.php?me#########################################
  • po###grave.net/forum/search.php?me#########################################
  • le###rave.net/forum/search.php?me#########################################
  • po###usual.net/forum/search.php?me#########################################
  • le###each.net/forum/search.php?me#########################################
  • ta###grave.net/forum/search.php?me#########################################
  • ca###sual.net/forum/search.php?me#########################################
  • po###teach.net/forum/search.php?me#########################################
  • ca###each.net/forum/search.php?me#########################################
  • po###could.net/forum/search.php?me#########################################
  • ca###ould.net/forum/search.php?me#########################################
UDP:
  • DNS ASK fi###news.net
  • DNS ASK th###state.net
  • DNS ASK so###news.net
  • DNS ASK so###mark.net
  • DNS ASK fi###mark.net
  • DNS ASK th###mark.net
  • DNS ASK li###ark.net
  • DNS ASK li###roke.net
  • DNS ASK li###tate.net
  • DNS ASK th###broke.net
  • DNS ASK fa###teach.net
  • DNS ASK ri###rave.net
  • DNS ASK ri###each.net
  • DNS ASK ri###ould.net
  • DNS ASK fa###could.net
  • DNS ASK so###broke.net
  • DNS ASK fi###broke.net
  • DNS ASK fi###state.net
  • DNS ASK fa###grave.net
  • DNS ASK so###state.net
  • DNS ASK le###roke.net
  • DNS ASK ta###mark.net
  • DNS ASK ta###broke.net
  • DNS ASK ta###state.net
  • DNS ASK le###tate.net
  • DNS ASK po###state.net
  • DNS ASK ca###tate.net
  • DNS ASK le###ews.net
  • DNS ASK le###ark.net
  • DNS ASK ta###news.net
  • DNS ASK we###tate.net
  • DNS ASK fe###roke.net
  • DNS ASK fe###tate.net
  • DNS ASK th###news.net
  • DNS ASK li###ews.net
  • DNS ASK fe###ews.net
  • DNS ASK we###ews.net
  • DNS ASK we###ark.net
  • DNS ASK we###roke.net
  • DNS ASK fe###ark.net
  • DNS ASK we###each.net
  • DNS ASK fe###rave.net
  • DNS ASK we###ould.net
  • DNS ASK fe###each.net
  • DNS ASK we###rave.net
  • DNS ASK ta###could.net
  • DNS ASK le###ould.net
  • DNS ASK ta###usual.net
  • DNS ASK le###sual.net
  • DNS ASK fe###ould.net
  • DNS ASK ja###uter.com
  • DNS ASK go#####everytime.com
  • DNS ASK do####club-grup.com
  • DNS ASK el#####arimagine.com
  • DNS ASK li###each.net
  • DNS ASK fe###sual.net
  • DNS ASK we###sual.net
  • DNS ASK th###grave.net
  • DNS ASK li###rave.net
  • DNS ASK ta###teach.net
  • DNS ASK li###sual.net
  • DNS ASK no###ould.net
  • DNS ASK ca###rave.net
  • DNS ASK no###sual.net
  • DNS ASK li###ould.net
  • DNS ASK ri###sual.net
  • DNS ASK fa###usual.net
  • DNS ASK no###each.net
  • DNS ASK no###rave.net
  • DNS ASK po###grave.net
  • DNS ASK le###rave.net
  • DNS ASK po###usual.net
  • DNS ASK le###each.net
  • DNS ASK ta###grave.net
  • DNS ASK ca###sual.net
  • DNS ASK po###teach.net
  • DNS ASK ca###each.net
  • DNS ASK po###could.net
  • DNS ASK ca###ould.net
  • '23#.#55.255.250':1900