マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Win32.HLLM.Graz.317

Added to the Dr.Web virus database: 2013-03-20

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\Pcmcia] 'Start' = '00000001'
  • [<HKLM>\SYSTEM\ControlSet001\Services\Modem] 'Start' = '00000001'
  • [<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'Start' = '00000002'
  • [<HKLM>\SYSTEM\ControlSet001\Services\netmoni] 'Start' = '00000002'
  • [<HKLM>\SYSTEM\ControlSet001\Services\Cdrom] 'Start' = '00000001'
  • [<HKLM>\SYSTEM\ControlSet001\Services\Flpydisk] 'Start' = '00000001'
Malicious functions:
Executes the following:
  • <SYSTEM32>\rundll32.exe "%ALLUSERSPROFILE%\application data\jgsoft\dllproject.dll" RunTest
  • <SYSTEM32>\wbem\wmiadap.exe /R /T
  • <SYSTEM32>\svchost.exe -k winmon
  • <SYSTEM32>\svchost.exe -k winmon2
Modifies file system :
Creates the following files:
  • <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
  • <SYSTEM32>\QMCture\winfile.qmfc
  • <SYSTEM32>\QMCture\winfile.qmfc-journal
  • %WINDIR%\Temp\_temp_dir.tmp
  • <SYSTEM32>\QMCture\mainwinfile.qmfc
  • <SYSTEM32>\QMCture\mainwinfile.qmfc-journal
  • C:\cmj.txt
  • %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll
  • %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll.dat
  • %ALLUSERSPROFILE%\Application Data\JGSoft\cmjfilem.sys
  • %ALLUSERSPROFILE%\Application Data\JGSoft\cmjNetDriver.sys
  • %ALLUSERSPROFILE%\Application Data\JGSoft\viewplug2004.dll
Deletes the following files:
  • <SYSTEM32>\QMCture\winfile.qmfc-journal
  • <SYSTEM32>\QMCture\mainwinfile.qmfc-journal
  • %WINDIR%\Temp\_temp_dir.tmp
  • %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll.dat
  • C:\cmj.txt
  • %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll
Network activity:
Connects to:
  • 'any':444
Miscellaneous:
Searches for the following windows:
  • ClassName: '' WindowName: 'WINHOST_SERVICE_MUTEX_D'
  • ClassName: '' WindowName: 'WINHOST_SERVICE_MUTEX_E'