Win32.HLLW.Autoruner1.16349

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procexp.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procexp.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\format.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiprsve.exe] 'Debugger' = '<SYSTEM32>.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killvb.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killvb.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A-VIGen32.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgamsvr.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A-VTray.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instal.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instal.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\VBSFile\Shell\Open\Command] '' = '"<SYSTEM32>.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\jpegfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\mp3file\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"%WINDIR%\adminisrative.exe" "%1" %*'
[<HKLM>\SYSTEM\ControlSet001\Control\SafeBoot\Minimal] 'vga.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet003\Control\SafeBoot\Minimal] 'vga.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet001\Control\SafeBoot\Minimal] 'dmboot.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet003\Control\SafeBoot\Minimal] 'dmboot.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet001\Control\SafeBoot\Network] 'vga.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet003\Control\SafeBoot\Network] 'vga.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet001\Control\SafeBoot\Network] 'dmboot.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SYSTEM\ControlSet003\Control\SafeBoot\Network] 'dmboot.sys' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe] 'Debugger' = '<SYSTEM32>\calc.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksplood.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Palma' = 'C:\My Music\Indonesia.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ParayCity' = 'C:\Send Mail.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\adminisrative.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = '%WINDIR%\adminisrative.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Massage' = 'C:\Manifesto.doc'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe] 'Debugger' = '<SYSTEM32>.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winRAR.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winzip.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgvv.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zanda.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupsvc.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav32.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe] 'Debugger' = '<SYSTEM32>\winmine.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\print.exe] 'Debugger' = '<SYSTEM32>\freecell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = '<SYSTEM32>\sol.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav32.exe] 'Debugger' = '<SYSTEM32>\spider.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe] 'Debugger' = '<SYSTEM32>\osx.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\wscsvc] 'ImagePath' = 'Go To Mak Erot'
[<HKLM>\SYSTEM\ControlSet001\Services\MSIServer] 'ImagePath' = 'Go To Vagina'
[<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'ImagePath' = 'BKHGkhvkBHhb'
[<HKLM>\SYSTEM\ControlSet001\Services\srservice\Parameters] 'ServiceDll' = 'jhgjhfHGDHdnhDNHCnhfdC'
[<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'ImagePath' = 'Dasar Kucing Garong lo '
[<HKLM>\SYSTEM\ControlSet001\Services\Alerter] 'ImagePath' = 'Mulutmu Harimaumu '

Creates the following files on removable media:

<Drive name for removable media>:\My Data\Ms Excel.exe
<Drive name for removable media>:\My Data\Powerpoint.exe
<Drive name for removable media>:\My Data\Persentasi.exe
<Drive name for removable media>:\My Gambar\Japan Pictures.exe
<Drive name for removable media>:\My Gambar\Artisz.exe
<Drive name for removable media>:\My Data\Ms Word.exe
<Drive name for removable media>:\My Data\Star Office.exe
<Drive name for removable media>:\My Data\Publisher.exe
<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\My Data\Skripsi.exe
<Drive name for removable media>:\My Data\Makalah.exe
<Drive name for removable media>:\My Data\Open Office.exe
<Drive name for removable media>:\My Music\Barat.exe
<Drive name for removable media>:\My Music\Rock Metal.exe
<Drive name for removable media>:\My Music\Malaysia.exe
<Drive name for removable media>:\U3.exe
<Drive name for removable media>:\My Music\Indonesia.exe
<Drive name for removable media>:\My Music\Mandarin.exe
<Drive name for removable media>:\My Gambar\Porno XXX.exe
<Drive name for removable media>:\My Gambar\Friendster.exe
<Drive name for removable media>:\My Gambar\Wallpaper.exe
<Drive name for removable media>:\My Music\Pop.exe
<Drive name for removable media>:\My Music\Dangdut.exe
<Drive name for removable media>:\My Gambar\Gadis Indo.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks execution of the following system utilities:

Command Prompt (CMD)
Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

blocks the following features:

System Restore (SR)

Creates and executes the following:

%WINDIR%\adminisrative.exe

Executes the following:

<SYSTEM32>\ping.exe -l 5000 -t www.fr###dster.com
<SYSTEM32>\ping.exe -l 5000 -t www.ma##ko.com
<SYSTEM32>\ping.exe -l 5000 -t www.vi####ndonesia.com
<SYSTEM32>\ping.exe -l 5000 -t www.an##v.com
<SYSTEM32>\ping.exe -l 5000 -t www.sm####ahandut.info

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoShellSearchButton' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDrives' = '00000004'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000004'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoShellSearchButton' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window Title' = 'Hayooo lagi ngapain?..... Lagi buka situs Porno yaaa..... (^_^)'

Forces autoplay for removable media.

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

C:\My Data\Ms Word.exe
C:\My Data\Ms Excel.exe
C:\My Data\Powerpoint.exe
C:\My Gambar\Artisz.exe
C:\My Gambar\Friendster.exe
C:\My Gambar\Wallpaper.exe
C:\My Gambar\Japan Pictures.exe
C:\My Data\Star Office.exe
C:\My Data\Publisher.exe
C:\Autorun.inf
C:\My Data\Open Office.exe
C:\My Data\Persentasi.exe
C:\My Data\Skripsi.exe
C:\My Data\Makalah.exe
C:\U3.exe
C:\My Music\Indonesia.exe
C:\My Music\Mandarin.exe
<SYSTEM32>.exe
C:\Manifesto.doc
C:\Send Mail.exe
%WINDIR%\adminisrative.exe
C:\My Music\Dangdut.exe
C:\My Gambar\Gadis Indo.exe
C:\My Gambar\Porno XXX.exe
C:\My Music\Pop.exe
C:\My Music\Barat.exe
C:\My Music\Rock Metal.exe
C:\My Music\Malaysia.exe

Sets the 'hidden' attribute to the following files:

C:\Autorun.inf
<Drive name for removable media>:\U3.exe
<Drive name for removable media>:\Autorun.inf
C:\U3.exe
C:\Manifesto.doc
C:\Send Mail.exe
%WINDIR%\adminisrative.exe

Deletes the following files:

<SYSTEM32>\Macromed\Flash\flash.ocx
<SYSTEM32>\spoolsv.exe

Network activity:

UDP:

DNS ASK www.fr###dster.com
DNS ASK www.ma##ko.com
DNS ASK www.sm####ahandut.info
DNS ASK www.vi####ndonesia.com
DNS ASK www.an##v.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'PROCESS'
ClassName: '' WindowName: 'Antivirus'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'ANSAV'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: 'Folder Options'
ClassName: '' WindowName: 'Task Manager'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information