Defend what you create

Mehr

Schließen

Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Schreiben Sie uns

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Win32.HLLW.Autoruner2.26715

Added to the Dr.Web virus database: 2016-11-27

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimpl.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccleaner.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serial.txt] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keygen.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regmon.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RootkitRevealer.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderui.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderml.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spidernt.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb32w.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = '<SYSTEM32>\diskbus.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adialhk.dll] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdev.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmount.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmount2.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGUARD.EXE] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPSRV.EXE] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVESVC.EXE] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.EXE] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spider.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tcpview.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avg.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\taskmon.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kernel32' = '<SYSTEM32>\com_services.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cureit.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serial.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crack.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Process Explorer.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessExplorer.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asc.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HiJackThis.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GetSystemInfo.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = '<SYSTEM32>\ServPnkBstr.exe'
Creates the following files on removable media:
  • <Drive name for removable media>:\drive.exe
  • <Drive name for removable media>:\Autorun.inf
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to file>' = '<Full path to file>:*:Enabled:updatekrn'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
modifies the following system settings:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Searches for windows to
detect analytical utilities:
  • ClassName: 'PROCEXPL' WindowName: ''
  • ClassName: 'TCPViewClass' WindowName: ''
  • ClassName: 'Autoruns' WindowName: ''
  • ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
  • ClassName: '' WindowName: 'TCPView - Sysinternals: www.sysinternals.com'
  • ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
Modifies file system:
Creates the following files:
  • <SYSTEM32>\temp89.wlw
  • <SYSTEM32>\diskbus.exe
  • C:\drive.exe
  • C:\Autorun.inf
  • <SYSTEM32>\taskmon.exe
  • <SYSTEM32>\com_services.exe
  • <SYSTEM32>\ServPnkBstr.exe
  • <SYSTEM32>\lpstdrv.exe
Sets the 'hidden' attribute to the following files:
  • <SYSTEM32>\ServPnkBstr.exe
  • <SYSTEM32>\diskbus.exe
  • <SYSTEM32>\temp89.wlw
  • <SYSTEM32>\lpstdrv.exe
  • <Full path to file>
  • <SYSTEM32>\com_services.exe
  • <SYSTEM32>\taskmon.exe
Miscellaneous:
Searches for the following windows:
  • ClassName: '' WindowName: 'Kaspersky Internet Security 6.0'
  • ClassName: '' WindowName: 'Kaspersky Internet Security 7.0'
  • ClassName: '' WindowName: 'Kaspersky Internet Security 8.0'
  • ClassName: '' WindowName: 'Kaspersky Internet Security 9.0'
  • ClassName: 'Button' WindowName: '????????????'
  • ClassName: '' WindowName: 'SpIDer Guard обнаружил вирус'
  • ClassName: '' WindowName: 'SpIDer Guard ????????? ?????'
  • ClassName: '' WindowName: 'Редактор реестра'
  • ClassName: '' WindowName: 'Dr.Web? ?????? ??? Windows (???????????????)'
  • ClassName: '' WindowName: 'Сетевой экран: мониторинг сети'
  • ClassName: '' WindowName: '??????? ?????: ?????????? ????'
  • ClassName: '' WindowName: 'Dr.Web® Сканер для Windows (ознакомительная)'
  • ClassName: '' WindowName: '???????? ???????'
  • ClassName: '' WindowName: 'Dr.Web® Сканер для Windows'
  • ClassName: '' WindowName: 'Dr.Web? ?????? ??? Windows'
  • ClassName: '' WindowName: 'П&родолжить'
  • ClassName: '' WindowName: '?&?????????'
  • ClassName: '' WindowName: 'Не &показывать в следующий раз'
  • ClassName: '' WindowName: '?????????? ?????????? ????????????'
  • ClassName: '' WindowName: '&Закрыть'
  • ClassName: '' WindowName: '&???????'
  • ClassName: '' WindowName: 'Результаты последнего сканирования'
  • ClassName: '' WindowName: '?? &?????????? ? ????????? ???'
  • ClassName: '' WindowName: 'Malware-сканер'
  • ClassName: '' WindowName: 'Malware-??????'
  • ClassName: 'Button' WindowName: 'Игнорировать'
  • ClassName: '' WindowName: '??????'
  • ClassName: '' WindowName: 'avast! - Предупреждение'
  • ClassName: '' WindowName: 'avast! - ??????????????'
  • ClassName: '' WindowName: 'Отмена'
  • ClassName: '' WindowName: 'Диспетчер задач Windows'
  • ClassName: '' WindowName: 'Настройка системы'
  • ClassName: '' WindowName: '????????? ???????'
  • ClassName: 'RootkitRevealerClass' WindowName: ''
  • ClassName: '' WindowName: '????????? ??????'
  • ClassName: '' WindowName: 'NOD32 2.5 Control Center'
  • ClassName: '' WindowName: 'NOD32 2.7 Control Center'
  • ClassName: '' WindowName: 'Командная строка'
  • ClassName: '18467-41' WindowName: ''
  • ClassName: '' WindowName: '???????? ?????????'
  • ClassName: '' WindowName: 'RootkitRevealer - Sysinternals: www.sysinternals.com'
  • ClassName: '' WindowName: 'CCleaner'
  • ClassName: '' WindowName: 'Файловый Антивирус'
  • ClassName: '' WindowName: 'Антивирусная утилита AVZ'
  • ClassName: '' WindowName: '???????????? ??????? AVZ'
  • ClassName: '' WindowName: 'NOD32'
  • ClassName: '' WindowName: '?pe???pe??e??e a?????p?c?o? c?c?e?? NOD32: AMON - ?????? ?? ???????'
  • ClassName: '' WindowName: 'Обновление'
  • ClassName: '' WindowName: '??????????'
  • ClassName: '' WindowName: 'Пpeдупpeждeниe aнтивиpуcнoй cиcтeмы NOD32: AMON - сканер по доступу'
  • ClassName: '' WindowName: '????????? ????? Windows'
  • ClassName: '' WindowName: 'ZoneAlarm'
  • ClassName: '' WindowName: 'ZoneAlarm Security Alert'
  • ClassName: '' WindowName: 'Лог событий'
  • ClassName: '' WindowName: 'IMON - Интернет-монитор'
  • ClassName: '' WindowName: 'IMON - ????????-???????'
  • ClassName: '' WindowName: 'NOD32 3.0 Control Center'
  • ClassName: '' WindowName: 'AMON - ?????? ?? ???????'
  • ClassName: '' WindowName: 'Лог вирусов'
  • ClassName: '' WindowName: '??? ???????'
  • ClassName: '' WindowName: 'AMON - сканер по доступу'

Führender russischer Hersteller von Virenschutzsoftware

Entwickelt seit 1992

Dr.Web wird in mehr als 200 Ländern genutzt

Antivirus im SaaS-Modell seit 2007

Technischer Support rund um die Uhr

© Doctor Web
2003 — 2019

Doctor Web ist ein russischer Entwickler von IT-Sicherheitslösungen unter dem Markennamen Dr.Web. Dr.Web Produkte werden seit 1992 entwickelt.

Doctor Web Deutschland GmbH. Quettigstr. 12, 76530 Baden-Baden