JavaScript support is required for our site to be fully operational in your browser.
Win32.Expiro.56
Added to the Dr.Web virus database:
2013-07-08
Virus description added:
2013-07-09
Technical Information
To ensure autorun and distribution:
Creates the following services:
[<HKLM>\SYSTEM\ControlSet001\Services\NetDDE] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\MSIServer] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\mnmsrvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\WmiApSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\VSS] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\clr_optimization_v2.0.50727_32] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ClipSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\CiSvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\clr_optimization_v4.0.30319_32] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ImapiService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\idsvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\dmadmin] 'Start' = '00000002'
Infects the following executable system files:
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\calc.exe
<SYSTEM32>\accwiz.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\mshearts.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\wupdmgr.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\odbcad32.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\cisvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
<SYSTEM32>\clipsrv.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\vssvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\smlogsvc.exe
Malicious functions:
Executes the following:
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {71118356-F5D5-4284-9C63-FF0E8DB68C22} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {1B89D4F8-3384-4EE5-808A-9A210CDD736D} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {13EC195B-15EF-41F1-9A81-405B802A2B14} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {572AF094-D63A-42D7-8E54-3E756B3FE51E} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {12704C5A-5F42-4D5B-831D-4DA2986073F4} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {A489EE1C-95C9-468C-BA2C-ADAC0391A6BC} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {AD225ED4-36D1-40B8-88AA-64BB32877AB1} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {1D459114-BCDD-43FE-82E7-FB081DEA2EF9} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'
'<SYSTEM32>\dmadmin.exe' /com
'<SYSTEM32>\cisvc.exe'
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe'
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {C02F1717-EE19-4751-8687-C8D3DC1ADF43} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {D1D0BF04-E0BB-4097-9490-AB7A1127A7E9} -Comment "NGen Worker Process"
'%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe'
'<SYSTEM32>\vssvc.exe'
Modifies settings of Windows Internet Explorer:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
欢迎下载 Dr.Web for Android
免费3个月
可使用所有保护组件
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息
OK