Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Win32.HLLW.Autoruner1.38479
Aggiunto al database dei virus Dr.Web:
2013-05-26
La descrizione è stata aggiunta:
2013-05-27
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '365' = 'h:\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '366' = 'C:\svchosto.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2297F138' = '%WINDIR%\2297F138\svchsot.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '364' = 'g:\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360' = '<SYSTEM32>\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '362' = '<Drive name for removable media>:\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '363' = 'f:\svchosto.exe'
Creates or modifies the following files:
%WINDIR%\Tasks\At10.job
%WINDIR%\Tasks\At9.job
%WINDIR%\Tasks\At8.job
%WINDIR%\Tasks\At13.job
%WINDIR%\Tasks\At12.job
%WINDIR%\Tasks\At11.job
%WINDIR%\Tasks\At7.job
%WINDIR%\Tasks\At3.job
%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At6.job
%WINDIR%\Tasks\At5.job
%WINDIR%\Tasks\At4.job
Creates the following services:
[<HKLM>\SYSTEM\ControlSet001\Services\ZHQHLPUZ] 'ImagePath' = '<DRIVERS>\ZHQHLPUZ.sys'
Creates the following files on removable media:
<Drive name for removable media>:\AutoRun.inf
<Drive name for removable media>:\svchosto.exe
Malicious functions:
Creates and executes the following:
'<SYSTEM32>\system.\svchosttt.exe'
'<SYSTEM32>\ksbinstaller_s_80_60899.exe'
'<SYSTEM32>\svchosttt.exe'
'<SYSTEM32>\KAVSETUPS_44_60899.exe'
'<SYSTEM32>\svchoppp.exe'
'C:\PPTV(pplive)_fora5_60899.exe'
'<SYSTEM32>\KAVSETUPS_44_60899.exe' (downloaded from the Internet)
'C:\PPTV(pplive)_fora5_60899.exe' (downloaded from the Internet)
'<SYSTEM32>\ksbinstaller_s_80_60899.exe' (downloaded from the Internet)
Executes the following:
'<SYSTEM32>\net1.exe' start "Task Scheduler"
Terminates or attempts to terminate
the following system processes:
Hooks the following functions in System Service Descriptor Table (SSDT):
NtWriteVirtualMemory, handler: ZHQHLPUZ.sys
NtReadVirtualMemory, handler: ZHQHLPUZ.sys
NtOpenProcess, handler: ZHQHLPUZ.sys
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
<SYSTEM32>\ksbinstaller_s_80_60899.exe
%WINDIR%\0C24_svchosttt.exe_0.ndmp
C:\PPTV(pplive)_fora5_60899.exe
<SYSTEM32>\KAVSETUPS_44_60899.exe
%WINDIR%\2297F138\svchsot.exe
<SYSTEM32>\system.\svchosttt.exe
<SYSTEM32>\svchosto.exe
C:\AutoRun.inf
<DRIVERS>\TMXMQTVA.sys
%WINDIR%\svchoppp.exe
<DRIVERS>\ZHQHLPUZ.sys
<SYSTEM32>\svchoppp.exe
C:\setups_66_63962.exe
<SYSTEM32>\svchosttt.exe
C:\kuping_s_33717.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2345[1]
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\AutoRun.inf
C:\AutoRun.inf
Deletes the following files:
<SYSTEM32>\svchosto.exe
<DRIVERS>\ZHQHLPUZ.sys
Network activity:
Connects to:
's1.##min6.com':80
'localhost':2012
'd.#####.ijinshan.com':80
'localhost':1037
'www.23##.com':80
TCP:
HTTP GET requests:
s1.##min6.com/pptv/PPTV(pplive)_fora5_60899.exe
d.#####.ijinshan.com/duba/link/KAVSETUPS_44_60899.exe
d.#####.ijinshan.com/liebao/link/ksbinstaller_s_80_60899.exe
www.23##.com/?k6#######
d.#####.ijinshan.com/kuping/jm/kuping_s_33717.exe
d.#####.ijinshan.com/weishi/link/setups_66_63962.exe
UDP:
DNS ASK cd#.###ent.baidu.com
DNS ASK do####ad.wuji.com
DNS ASK qw####800.gicp.net
DNS ASK ji#####wnload.2345.cn
DNS ASK www.23##.com
DNS ASK d.#####.ijinshan.com
DNS ASK s1.##min6.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Button' WindowName: '????(&I)'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '#32770' WindowName: '2345????????????V3.2??????????60??????????????????'
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK