Win32.HLLW.Muspace.7
Added to the Dr.Web virus database:
2016-04-05
Virus description added:
2016-04-04
Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' stop SharedAccess
- '<SYSTEM32>\cmd.exe' /c c:\RECYCLER\svchost.bat
- '<SYSTEM32>\netsh.exe' firewallset opmode disable
- '<SYSTEM32>\net.exe' stop SharedAccess
Modifies file system:
Creates the following files:
- C:\RECYCLER\ntldr.sys
- C:\RECYCLER\ntldre.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\boot.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.DRV
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.SYS
- C:\RECYCLER\ntldrc.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.EXE\SHORTCUT.DLL
- %ALLUSERSPROFILE%\Application Data\Microsoft\STOPRUN.SYS
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SOFTWARE.SET
- C:\RECYCLER\svchost.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SYSTEM.SET
Deletes the following files:
- C:\RECYCLER\svchost.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.SYS
- C:\RECYCLER\ntldre.sys
- C:\RECYCLER\ntldr.sys
- C:\RECYCLER\ntldrc.sys
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息