Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Win32.HLLW.Autoruner1.45438

Added to the Dr.Web virus database: 2013-06-18

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following files on removable media:
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\main.exe
Malicious functions:
Executes the following:
  • '<SYSTEM32>\attrib.exe' +h %APPDATA%\pthreadGC2.dll
  • '<SYSTEM32>\attrib.exe' +h %APPDATA%\libcurl-4.dll
  • '<SYSTEM32>\attrib.exe' +h %APPDATA%\cpuminer.zip
  • '<SYSTEM32>\attrib.exe' +h %APPDATA%\minerd.exe
Modifies file system :
Creates the following files:
  • %APPDATA%\svchost.exe
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\main.exe
  • %APPDATA%\svchost.exe
Network activity:
Connects to:
  • 'po##.#jpool.info':9332
  • 'localhost':1037
UDP:
  • DNS ASK hi#######y.dl.sourceforge.net
  • DNS ASK po##.#jpool.info