Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Win32.HLLW.Autoruner1.51068

Added to the Dr.Web virus database: 2013-07-20

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%TEMP%\javaSetup.exe' /s REBOOT=Suppress JAVAUPDATE=0 WEBSTARTICON=0
  • '%TEMP%\javaSetup.exe' (downloaded from the Internet)
Executes the following:
  • '<SYSTEM32>\cscript.exe' //NoLogo %TEMP%\hd.vbs
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\Zona\License_uk.rtf
  • %PROGRAM_FILES%\Zona\License_ru.rtf
  • %PROGRAM_FILES%\Zona\License_en.rtf
  • %TEMP%\appdata.7z
  • %TEMP%\Zona.7z
  • %PROGRAM_FILES%\Zona\utils.jar
  • %APPDATA%\Zona\init.xml
  • %TEMP%\ZonaInstall.log
  • %TEMP%\hd.vbs
  • %TEMP%\javaSetup.exe
  • %TEMP%\zon2.tmp
Network activity:
Connects to:
  • 'i2.#8.net':80
  • 'zo#a.ru':80
TCP:
HTTP GET requests:
  • zo#a.ru/Zona.7z
  • zo#a.ru/appdata.7z
  • i2.#8.net/T/gJr_X.jpeg
  • zo#a.ru/jre_latest.exe
UDP:
  • DNS ASK dl.#ona.ru
  • DNS ASK i2.#8.net
  • DNS ASK zo#a.ru
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'