ユーザー向け情報

マイライブラリ

+ マイライブラリに追加

検索

テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話

フォーラム（英語）

お問い合わせ履歴

すべて: -
対応中: -
最終更新: -

新規お問い合わせ

電話

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY ID

サービス

スキャナー

Dr.Web vxCube

トライアル

Dr.Web vxCubeにログオン

ウイルスライブラリ

ウイルス検索

ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

アンチウイルスに関する誤解

ニュース

Win32.VirLock.10

Added to the Dr.Web virus database: 2015-02-18

Virus description added: 2015-02-18

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AcIcUcAM.exe' = '%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jaQEcQMQ.exe' = '%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\FkYQcQph] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

'%ALLUSERSPROFILE%\lwQggIEM\nwAEcgMA.exe'
'%ALLUSERSPROFILE%\vesswIQA\AcIcUcAM.exe'
'%HOMEPATH%\NIMMEwsg\jaQEcQMQ.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Modifies file system :

Creates the following files:

Deletes the following files:

<Current directory>\gUAw.exe
<Current directory>\hcUM.ico
<Current directory>\qEcY.ico
<Current directory>\BkwI.ico
<Current directory>\ZYoa.exe
<Current directory>\koQe.exe
<Current directory>\nIEI.exe
<Current directory>\Pqsk.ico
<Current directory>\rmow.ico
<Current directory>\iYQM.ico
<Current directory>\iYci.exe
<Current directory>\SYYi.exe
<Current directory>\qgsc.exe
<Current directory>\LosM.ico
<Current directory>\zMkQ.ico
%TEMP%\ZyAoUAMU.bat
<Current directory>\fAIE.exe
<Current directory>\cUMo.exe
<Current directory>\HooS.exe
<Current directory>\rOwI.ico
<Current directory>\aWcw.ico
<Current directory>\ZEwE.ico
<Current directory>\lgYu.exe

Moves the following files:

from C:\RCX8.tmp to <Current directory>\gUAw.exe
from C:\RCX7.tmp to <Current directory>\ZYoa.exe
from C:\RCX9.tmp to <Current directory>\koQe.exe
from C:\RCXB.tmp to <Current directory>\nIEI.exe
from C:\RCXA.tmp to <Current directory>\iYci.exe
from C:\RCX6.tmp to <Current directory>\SYYi.exe
from C:\RCX2.tmp to <Current directory>\qgsc.exe
from C:\RCX1.tmp to <Current directory>\fAIE.exe
from C:\RCX3.tmp to <Current directory>\cUMo.exe
from C:\RCX5.tmp to <Current directory>\HooS.exe
from C:\RCX4.tmp to <Current directory>\lgYu.exe

Network activity:

Connects to:

'bl##k.io':443

UDP:

DNS ASK google.com
DNS ASK bl##k.io

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'AcIcUcAM.exe'
ClassName: 'Indicator' WindowName: ''