Win32.HLLW.Autoruner.54124
Added to the Dr.Web virus database:
2011-07-12
Virus description added:
2011-07-12
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{8YX22I7N-HF2T-U363-JDAQ-PBU27D65AUO8}] 'StubPath' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe %WINDIR%\Regsvrkn9.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = ''
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
blocks the following features:
Creates and executes the following:
- %TEMP%\lol2.exe
- %TEMP%\lol1.exe
Executes the following:
- <SYSTEM32>\attrib.exe +h +s +a +r U:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r U:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r T:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r T:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r W:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r W:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r V:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r V:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r Q:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r Q:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r P:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r P:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r S:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r S:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r R:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r R:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r X:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn10.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn11.exe
- <SYSTEM32>\attrib.exe +h +s +a +r <SYSTEM32>\Regsvrkn4.exe
- <SYSTEM32>\attrib.exe +h +s +a +r <SYSTEM32>\Regsvrkn5.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn14.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn15.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn12.exe
- <SYSTEM32>\attrib.exe +h +s +a +r %WINDIR%\Regsvrkn13.exe
- <SYSTEM32>\attrib.exe +h +s +a +r Y:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r Z:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r X:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r Y:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r <SYSTEM32>\Regsvrkn2.exe
- <SYSTEM32>\attrib.exe +h +s +a +r <SYSTEM32>\Regsvrkn3.exe
- <SYSTEM32>\attrib.exe +h +s +a +r Z:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r <SYSTEM32>\Regsvrkn1.exe
- <SYSTEM32>\attrib.exe +h +s +a +r E:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r E:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r <Drive name for removable media>:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r <Drive name for removable media>:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r F:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r G:\Regsvrkn.exe
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %WINDIR%\698chym_bupbe.jpg
- <SYSTEM32>\attrib.exe +h +s +a +r F:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r A:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r A:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r%WINDIR%\Regsvrkn9.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\attrib.exe +h +s +a +r C:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r C:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r B:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r B:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r G:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r M:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r M:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r L:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r L:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r O:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r O:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r N:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r N:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r I:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r I:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r H:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r H:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r K:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r K:\autorun.inf
- <SYSTEM32>\attrib.exe +h +s +a +r J:\Regsvrkn.exe
- <SYSTEM32>\attrib.exe +h +s +a +r J:\autorun.inf
Modifies settings of Windows Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
Hides the following processes:
Modifies file system :
Creates the following files:
- %WINDIR%\Regsvrkn11.bat
- %WINDIR%\Regsvrkn12.bat
- <SYSTEM32>\Regsvrkn5.bat
- %WINDIR%\Regsvrkn10.bat
- %WINDIR%\Regsvrkn13.bat
- %HOMEPATH%\Recent\698chym_bupbe.lnk
- %WINDIR%\Regsvrkn16.bat
- %WINDIR%\Regsvrkn14.bat
- %WINDIR%\Regsvrkn15.bat
- <SYSTEM32>\Regsvrkn4.bat
- C:\autorun.inf
- %WINDIR%\698chym_bupbe.jpg.exe
- %TEMP%\lol1.exe
- %TEMP%\lol2.exe
- %WINDIR%\698chym_bupbe.jpg
- <SYSTEM32>\Regsvrkn2.bat
- <SYSTEM32>\Regsvrkn3.bat
- %WINDIR%\InstallDir\Server.exe
- <SYSTEM32>\Regsvrkn1.bat
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autorun.inf
- %WINDIR%\InstallDir\Server.exe
- %TEMP%\lol2.exe
- C:\autorun.inf
Network activity:
Connects to:
- 'bu######huongvn.no-ip.org':81
- 'localhost':1036
UDP:
- DNS ASK bu######huongvn.no-ip.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息