マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Win32.HLLW.Autoruner1.32327

Added to the Dr.Web virus database: 2013-01-08

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'COMLOADER' = '\\.\D:\Program Files\FoxitReader\bin\COM7.EXE'
Creates or modifies the following files
  • %HOMEPATH%\start menu\programs\startup\pdf foxitreader.exe
Creates the following files on removable media
  • <Drive name for removable media>:\pdf reader 2012.exe.exe
  • <Drive name for removable media>:\recycled\taskssvh.exe
  • <Drive name for removable media>:\music.lnk
  • <Drive name for removable media>:\recycled.lnk
Modifies file system
Creates the following files
  • %TEMP%\rar$ex7.src777\achsv.exe
  • %TEMP%\rar$ex7.src777\com7.exe
  • %TEMP%\.bat
  • %TEMP%\rar$ex7.src777\pipe.exc777.tmp
  • D:\program files\foxitreader\bin\com7.exe
  • D:\program files\foxitreader\foxitreader.exe
Substitutes the following files
  • %TEMP%\.bat
Network activity
UDP
  • DNS ASK ib###e.eb2a.com
Miscellaneous
Creates and executes the following
  • '%TEMP%\rar$ex7.src777\achsv.exe'
  • '%TEMP%\rar$ex7.src777\com7.exe'
  • '<SYSTEM32>\cmd.exe' /c ""%TEMP%\.bat" "' (with hidden window)
  • '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\D:\Program Files\FoxitReader\bin\COM7.EXE"' (with hidden window)
Executes the following
  • '<SYSTEM32>\cmd.exe' /c ""%TEMP%\.bat" "
  • '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\D:\Program Files\FoxitReader\bin\COM7.EXE"