Win32.HLLW.Autoruner2.24498
Added to the Dr.Web virus database:
2016-06-20
Virus description added:
2016-06-20
Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\DriverDetective.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 34AE15ADDBA5D72292A7F142C933173C C
- '<SYSTEM32>\msiexec.exe' /V
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
Modifies file system:
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\isprba3e.rra
- %TEMP%\b721.rra
- %TEMP%\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isconfig.xml
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\0x0409.ini
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Driver Detective.msi
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Driver Detective.msi
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\ISSetup.dll
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\Setup.INI
- <LS_APPDATA>\Downloaded Installations\{8A8741C3-6387-40D0-9DCF-757209EF9522}\setup.isn
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Splash.bmp
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\_ISMSIDEL.INI
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\Setup.INI
- %APPDATA%\DriverDetective.exe
- %TEMP%\~1.tmp
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\setup.isn
- %TEMP%\{7681E9B2-69B6-47E2-A388-E4A95A0F9910}\0x0409.ini
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isuser.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\String1033.txt
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\_isres.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\DialogBitmap.bmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\EULA.rtf
- %TEMP%\MSI2.tmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\ISRT.dll
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\setup.inx
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
Deletes the following files:
- %TEMP%\MSI3.tmp
- %TEMP%\{BCA8A6B1-3B80-4BE9-BF09-68BC83D53EFC}\skinba9b.rra
- %TEMP%\~1.tmp
- %TEMP%\MSI2.tmp
Network activity:
Connects to:
- 'cs######4-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://CS######4-crl.verisign.com/CSC3-2004.crl via cs######4-crl.verisign.com
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK cs######4-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息