Pour les utilisateurs

Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche

Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

Forum

Vos requêtes

Toutes : -
Non clôturées : -
Dernière : le -

Créer une nouvelle requête

Nous téléphoner

FR

RU CN DE EN ES FR IT JP KZ UZ PL BY ID

Services support

Dr.Web vxCube

Connexion à Dr.Web vxCube

Bibliothèque virale

Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Mythes sur les antivirus

Actualités

Win32.HLLW.Autoruner.53971

Added to the Dr.Web virus database: 2011-07-10

Virus description added: 2011-07-11

Technical Information

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\AUTORUN.INF
<Drive name for removable media>:\explorer.exe

Malicious functions:

Executes the following:

<SYSTEM32>\net1.exe stop "McAfee Framework ·юОс"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Server"
<SYSTEM32>\cacls.exe <SYSTEM32>\packet.dll /e /p everyone:f
<SYSTEM32>\net1.exe stop "Symantec AntiVirus"
<SYSTEM32>\net.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net1.exe stop "Symantec AntiVirus Definition Watcher"
<SYSTEM32>\cacls.exe <SYSTEM32>\pthreadVC.dll /e /p everyone:f
<SYSTEM32>\cacls.exe <DRIVERS>\acpidisk.sys /e /p everyone:f
<SYSTEM32>\cacls.exe <SYSTEM32>\wanpacket.dll /e /p everyone:f
<SYSTEM32>\cacls.exe %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\Жф¶Ї /e /p everyone:f
<SYSTEM32>\cacls.exe <SYSTEM32>\wpcap.dll /e /p everyone:f
<SYSTEM32>\cacls.exe <DRIVERS>\npf.sys /e /p everyone:f
<SYSTEM32>\cacls.exe <SYSTEM32>\npptools.dll /e /p everyone:f
<SYSTEM32>\net.exe stop DefWatch
<SYSTEM32>\net1.exe stop McShield
<SYSTEM32>\net1.exe stop KWhatchsvc
<SYSTEM32>\net.exe stop McShield
<SYSTEM32>\net.exe stop KWhatchsvc
<SYSTEM32>\net.exe stop KPfwSvc
<SYSTEM32>\net.exe stop "Symantec AntiVirus Client"
<SYSTEM32>\net.exe stop "Symantec AntiVirus Definition Watcher"
<SYSTEM32>\net1.exe stop "Symantec AntiVirus Client"
<SYSTEM32>\net.exe stop "McAfee Framework ·юОс"
<SYSTEM32>\net1.exe stop KPfwSvc
<SYSTEM32>\net.exe stop "Symantec AntiVirus"
<SYSTEM32>\net1.exe stop DefWatch

Modifies file system :

Creates the following files:

C:\explorer.exe
C:\AUTORUN.INF
<SYSTEM32>\Iparmor.dll
<SYSTEM32>\wuauc1t.exe

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\AUTORUN.INF
C:\AUTORUN.INF
<Full path to virus>