Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Win32.HLLW.Autoruner1.46366

Added to the Dr.Web virus database: 2013-07-15

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following files on removable media:
  • <Drive name for removable media>:\<Virus name>.exe
  • <Drive name for removable media>:\autorun.inf
Malicious functions:
Executes the following:
  • '<SYSTEM32>\ntvdm.exe' -f -i1
Modifies file system :
Creates the following files:
  • C:\<Virus name>.exe
  • %WINDIR%\Temp\scs1.tmp
  • %WINDIR%\Temp\scs2.tmp
  • C:\<Virus name>A.exe
  • <Current directory>\<Virus name>.doc
  • C:\autorun.inf
Deletes the following files:
  • %WINDIR%\Temp\scs2.tmp
  • %WINDIR%\Temp\scs1.tmp
  • <Current directory>\<Virus name>.doc
Miscellaneous:
Searches for the following windows:
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ae8.aec.380001'
  • ClassName: '(null)' WindowName: 'last'
  • ClassName: '(null)' WindowName: 'last1'