Win32.HLLW.Facebook.1003
Added to the Dr.Web virus database:
2011-08-15
Virus description added:
2011-08-16
Technical Information
Malicious functions:
Creates and executes the following:
- <Full path to virus>.exe /arg_oko
Executes the following:
- <SYSTEM32>\netsh.exe fIrEwaLl AdD AllOWeDPrOgrAm naMe="FlashFXP OKO" prOGram="<SYSTEM32>\svchost.exe" mode=ENABLE
- <SYSTEM32>\netsh.exe fIrEwaLl AdD pOrToPEnIng tcP 8085 "GateOKO" eNABLe
- <SYSTEM32>\reg.exe aDd "hklm\SOFTWARE\Microsoft\Internet Explorer\Main" /v TP /t ReG_Sz /d 1000 /f
- <SYSTEM32>\cmd.exe /c ""<Full path to virus>.exe" /arg_oko > ""%TEMP%\o6ko.bat"""
- <SYSTEM32>\cmd.exe /c ""%TEMP%\o6ko.bat""
Modifies file system :
Creates the following files:
- <SYSTEM32>\o6ko.dll
- %TEMP%\o6ko.bat
- <Full path to virus>.exe
- <DRIVERS>\o6ko.sys
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息