FÜR NUTZER

Meine Bibliothek

+ Zur Bibliothek hinzufügen

Suche

Support 24/7 | Regeln zur Anfragenübermittlung

Schreiben Sie uns

Online-Formular

Telefon

+49 (0) 170 488 40 28

Forum

Ihre Anfragen

Alle: -
Offen: -
Letzte Anfrage: -

Rufen Sie uns an

+7 (495) 789-45-86

DE

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

Sign in to Dr.Web vxCube

Analyse von virenabhängigen Vorfällen

Virenbibliothek

Wissensdatenbank

Technologies

Begriffe

Schulung und Training

Mythen

Mythen über Virenschutzsoftware

Win32.HLLW.Autoruner1.34285

Added to the Dr.Web virus database: 2013-03-22

Virus description added: 2013-03-22

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Windows_UpDate] 'Start' = '00000002'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\PScs2.exe

Malicious functions:

Creates and executes the following:

<LS_APPDATA>\s.exe

Executes the following:

<SYSTEM32>\attrib.exe +h f:\autorun.inf
<SYSTEM32>\attrib.exe +h g:\autorun.inf
<SYSTEM32>\attrib.exe +h <Drive name for removable media>:\autorun.inf
<SYSTEM32>\attrib.exe +h e:\autorun.inf
<SYSTEM32>\attrib.exe +h j:\autorun.inf
<SYSTEM32>\calc.exe
<SYSTEM32>\attrib.exe +h h:\autorun.inf
<SYSTEM32>\attrib.exe +h i:\autorun.inf
<SYSTEM32>\attrib.exe +h c:\autorun.inf
<SYSTEM32>\attrib.exe +h e:\PScs2.exe
<SYSTEM32>\attrib.exe +h f:\PScs2.exe
<SYSTEM32>\attrib.exe +h c:\PScs2.exe
<SYSTEM32>\attrib.exe +h <Drive name for removable media>:\PScs2.exe
<SYSTEM32>\attrib.exe +h i:\PScs2.exe
<SYSTEM32>\attrib.exe +h j:\PScs2.exe
<SYSTEM32>\attrib.exe +h g:\PScs2.exe
<SYSTEM32>\attrib.exe +h h:\PScs2.exe

Injects code into

the following system processes:

<SYSTEM32>\calc.exe

Modifies file system :

Creates the following files:

C:\autorun.inf
<SYSTEM32>\PScs2.exe
<SYSTEM32>\_rejoice082.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\rejoice082.exe
C:\PScs2.exe
<LS_APPDATA>\AutoRun.inf
<LS_APPDATA>\s.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\FieleWay.txt
%TEMP%\a78540.bat

Sets the 'hidden' attribute to the following files:

C:\autorun.inf
<Drive name for removable media>:\autorun.inf
<SYSTEM32>\_rejoice082.exe
<Drive name for removable media>:\PScs2.exe
%TEMP%\a78540.bat
%CommonProgramFiles%\Microsoft Shared\MSInfo\rejoice082.exe
C:\PScs2.exe

Deletes the following files:

%CommonProgramFiles%\Microsoft Shared\MSInfo\FieleWay.txt
<LS_APPDATA>\s.exe

Network activity:

Connects to:

'gu#####2008.51vip.biz':3313

UDP:

DNS ASK gu#####2008.51vip.biz

Miscellaneous:

Searches for the following windows:

ClassName: 'TSxre2008' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''
ClassName: 'TAppBuilder' WindowName: ''