Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Win32.HLLM.MyDoom.1336

Added to the Dr.Web virus database: 2013-05-29

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%TEMP%\RarSFX0\reg.exe'
  • '%TEMP%\RarSFX0\avvio.exe'
Executes the following:
  • '<SYSTEM32>\xcopy.exe' "start.vbs" "<SYSTEM32>" /v /c /i /q /g /r /y
  • '<SYSTEM32>\shutdown.exe' /r /t 5 /c "Errore nel sitema. Windows verra' riavviato" /f
  • '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\avvio.cmd""
  • '<SYSTEM32>\xcopy.exe' "driverUSB.exe" "%WINDIR%" /v /c /i /q /g /r /y
Modifies file system :
Creates the following files:
  • %TEMP%\1.tmp\avvio.cmd
  • %TEMP%\RarSFX0\start.vbs
  • <SYSTEM32>\start.vbs
  • %WINDIR%\DriverUSB.exe
  • %TEMP%\RarSFX0\chiave.reg
  • %TEMP%\RarSFX0\avvio.exe
  • %TEMP%\RarSFX0\reg.exe
  • %TEMP%\RarSFX0\DriverUSB.exe
Deletes the following files:
  • %TEMP%\1.tmp\avvio.cmd
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'EDIT' WindowName: ''