Win32.HLLW.Autoruner2.17586
Added to the Dr.Web virus database:
2014-10-06
Virus description added:
2014-10-06
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TransToolbar' = 'lsass.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinWord' = '<SYSTEM32>\Winword.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Service' = '<SYSTEM32>\nfs.exe'
- [<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = 'aurel.exe %1'
- [<HKLM>\SOFTWARE\Classes\txtfile\shell\open\command] '' = 'Rundll32.exe %1'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = 'msconfig.exe %1'
- [<HKLM>\SOFTWARE\Classes\mpegfile\shell\open\command] '' = 'lsass.exe %1'
Changes the following executable system files:
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\NEW DOCUMENT.EXE
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Terminates or attempts to terminate
the following user processes:
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000030'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Internet Explorer\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Messenger\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\ShellExt\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\config\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Back up Aishwara Rai.Docx.exe
- %WINDIR%\Debug\Back up Aishwara Rai.Docx.exe
- %WINDIR%\Media\Back up Aishwara Rai.Docx.exe
- %WINDIR%\Prefetch\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Movie Maker\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Online Services\Back up Aishwara Rai.Docx.exe
- %PROGRAM_FILES%\Windows Media Player\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\spool\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\msconfig.exe
- <SYSTEM32>\aurel.exe
- %WINDIR%\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\avp.exe
- <SYSTEM32>\winword.exe
- <SYSTEM32>\mui\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\Setup\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\ras\Back up Aishwara Rai.Docx.exe
- %WINDIR%\Temp\Back up Aishwara Rai.Docx.exe
- %WINDIR%\system\Back up Aishwara Rai.Docx.exe
- <SYSTEM32>\DirectX\Back up Aishwara Rai.Docx.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\aurel.exe
- <Drive name for removable media>:\NEW DOCUMENT.EXE
- <Drive name for removable media>:\autorun.inf
- <SYSTEM32>\avp.exe
- <SYSTEM32>\winword.exe
- <SYSTEM32>\msconfig.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息