Win32.HLLW.Autoruner1.35899
Added to the Dr.Web virus database:
2013-04-29
Virus description added:
2013-05-04
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run] 'windows help services' = '<SYSTEM32>\helpsrv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dhcp client' = '%WINDIR%\dhcp.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\Girl.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
Creates and executes the following:
- '<SYSTEM32>\helpsrv.exe'
- '%WINDIR%\dhcp.exe'
Executes the following:
- '<SYSTEM32>\sc.exe' delete srservice
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop srservice
- '<SYSTEM32>\sc.exe' stop sharedaccess
- '<SYSTEM32>\sc.exe' delete sharedaccess
- '<SYSTEM32>\cmd.exe' /c %TEMP%\_dhS.bat
- '<SYSTEM32>\diskpart.exe' /s %TEMP%\hcdRS.dat
- '<SYSTEM32>\sc.exe' delete avp
- '<SYSTEM32>\sc.exe' delete wuauserv
- '<SYSTEM32>\sc.exe' stop avp
- '<SYSTEM32>\sc.exe' stop spooler
- '<SYSTEM32>\sc.exe' start themes
- '<SYSTEM32>\sc.exe' delete audiosrv
- '<SYSTEM32>\cmd.exe' /c %TEMP%\_dSC.bat
- '<SYSTEM32>\sc.exe' stop audiosrv
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\sc.exe' delete wscsvc
- '<SYSTEM32>\sc.exe' delete sens
- '<SYSTEM32>\sc.exe' delete spooler
- '<SYSTEM32>\sc.exe' stop sens
Terminates or attempts to terminate
the following user processes:
Modifies settings of Windows Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'nosecuritytab' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'nosecuritytab' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'nofind' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'norun' = '00000001'
Modifies file system :
Creates the following files:
- <SYSTEM32>\helpsrv.exe
- <Current directory>\<Virus name>\Funny.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- <SYSTEM32>\directx.exe
- <SYSTEM32>\igfx32.lrc
- %WINDIR%\dhcp.exe
- <SYSTEM32>\grouppolicy\machine\scripts\startup\ftdisk.exe
- C:\autorun.inf
- %TEMP%\sdlld2.dat
- %TEMP%\sdlld3.dat
- %TEMP%\_DLLd.bat
- %TEMP%\sdlld1.dat
- C:\Girl.exe
- %TEMP%\hcdRS.dat
- %TEMP%\_dhS.bat
- %WINDIR%\Help\ipshelp.hlp
- %WINDIR%\Temp\sync.adm
- %WINDIR%\Temp\dradmin.adm
- %WINDIR%\Temp\help.chm
- %WINDIR%\Temp\explorer.adm
- %TEMP%\_dSC.bat
- %WINDIR%\Temp\user.adm
- %WINDIR%\Temp\misc.dll
- %WINDIR%\Temp\system.adm
- <SYSTEM32>\dhcp.sys
- <SYSTEM32>\ftdisk.sys
- <SYSTEM32>\dpvsrv.dll
- <SYSTEM32>\compmhelp.htm
- %WINDIR%\Temp\host.ocx
- <SYSTEM32>\initgdi32.cui
- <SYSTEM32>\cmediahelp.chm
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\Girl.exe
- %TEMP%\_dhS.bat
- C:\Girl.exe
- %TEMP%\_dSC.bat
- <Current directory>\<Virus name>\Funny.exe
- C:\autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'rebarwindow32' WindowName: ''
- ClassName: 'workerw' WindowName: ''
- ClassName: 'explorewclass' WindowName: ''
- ClassName: 'comboboxex32' WindowName: ''
- ClassName: 'cabinetwclass' WindowName: ''
- ClassName: '' WindowName: 'windows task manager'
- ClassName: '' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: ''
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息