Pour les utilisateurs

Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche

Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

Forum

Vos requêtes

Toutes : -
Non clôturées : -
Dernière : le -

Créer une nouvelle requête

Nous téléphoner

FR

RU CN DE EN ES FR IT JP KZ UZ PL BY

Services support

Dr.Web vxCube

Connexion à Dr.Web vxCube

Bibliothèque virale

Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Mythes sur les antivirus

Actualités

Win32.HLLW.Autoruner1.34255

Added to the Dr.Web virus database: 2013-03-21

Virus description added: 2013-03-22

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Internet Service' = ''

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Windows Internet Service] 'Start' = '00000002'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\<Virus name>.exe

Malicious functions:

Creates and executes the following:

%WINDIR%\Temp\AUT0EXEC.BAT
<SYSTEM32>\Windows Internet Service.exe
%WINDIR%\Temp\AUT0EXEC.BAT (downloaded from the Internet)

Executes the following:

<SYSTEM32>\taskkill.exe /f /im KRegEx.exe
<SYSTEM32>\taskkill.exe /f /im KVSrvXP.exe
<SYSTEM32>\taskkill.exe /f /im UIHost.exe
<SYSTEM32>\taskkill.exe /f /im KVXP.kxp
<SYSTEM32>\taskkill.exe /f /im KvMonXP.kxp
<SYSTEM32>\taskkill.exe /f /im KVCenter.kxp
<SYSTEM32>\taskkill.exe /f /im Logo_1.exe
<SYSTEM32>\taskkill.exe /f /im Rundl132.exe
<SYSTEM32>\taskkill.exe /f /im 360tray.exe
<SYSTEM32>\taskkill.exe /f /im TrojDie.kxp
<SYSTEM32>\taskkill.exe /f /im FrogAgent.exe
<SYSTEM32>\taskkill.exe /f /im Logo1_.exe
<SYSTEM32>\taskkill.exe /f /im UpdaterUI.exe
<SYSTEM32>\taskkill.exe /f /im TBMon.exe
<SYSTEM32>\taskkill.exe /f /im scan32.exe
<SYSTEM32>\taskkill.exe /f /im Mcshield.exe
<SYSTEM32>\taskkill.exe /f /im VsTskMgr.exe
<SYSTEM32>\taskkill.exe /f /im naPrdMgr.exe
<SYSTEM32>\taskkill.exe /f /im Rav.exe
<SYSTEM32>\taskkill.exe /f /im Ravmon.exe
<SYSTEM32>\taskkill.exe /f /im RavStub.exe
<SYSTEM32>\taskkill.exe /f /im Ravmond.exe
<SYSTEM32>\taskkill.exe /f /im CCenter.exe
<SYSTEM32>\taskkill.exe /f /im RavTask.exe

Terminates or attempts to terminate

the following user processes:

360tray.exe

Modifies file system :

Creates the following files:

C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cs[1].exe
%WINDIR%\Temp\AUT0EXEC.BAT
C:\<Virus name>.exe
<SYSTEM32>\explorer.exe
<SYSTEM32>\Windows Internet Service.exe
<Current directory>\Autorun.inf

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\<Virus name>.exe
<Drive name for removable media>:\autorun.inf
C:\autorun.inf
<SYSTEM32>\explorer.exe
C:\<Virus name>.exe

Network activity:

Connects to:

'www.hk##r.cn':80
'localhost':1035

TCP:

HTTP GET requests:

www.hk##r.cn/cs.exe

UDP:

DNS ASK www.hk##r.cn

Miscellaneous:

Searches for the following windows:

ClassName: 'IEFrame' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''