マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Win32.HLLW.Autoruner1.27601

Added to the Dr.Web virus database: 2012-10-11

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following files on removable media:
  • <Drive name for removable media>:\pagefile.pif
  • <Drive name for removable media>:\AUTORUN.INF
Malicious functions:
Creates and executes the following:
  • <SYSTEM32>\Com\smss.exe
  • <SYSTEM32>\Com\lsass.exe
  • %TEMP%\RarSFX0\Setup.exe
Executes the following:
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com\lsass.exe /e /t /g Everyone:F
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com\smss.exe /e /t /g %USERNAME%:F
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com\smss.exe /e /t /g Everyone:F
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com\lsass.exe /e /t /g %USERNAME%:F
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com /e /t /g %USERNAME%:F
  • <SYSTEM32>\cacls.exe <SYSTEM32>\com /e /t /g Everyone:F
  • <SYSTEM32>\regsvr32.exe <SYSTEM32>\com\netcfg.dll /s
Terminates or attempts to terminate
the following user processes:
  • AVPCC.EXE
  • AVPM.EXE
  • GUARD.EXE
  • AVP.COM
  • AVP.EXE
  • AVP32.EXE
Modifies file system :
Creates the following files:
  • <SYSTEM32>\167688.log
  • C:\037589.log
  • <SYSTEM32>\dnsq.dll
  • C:\pagefile.pif
  • C:\AUTORUN.INF
  • <SYSTEM32>\Com\lsass.exe
  • C:\NetApi000.sys
  • %TEMP%\RarSFX0\Setup.exe
  • <SYSTEM32>\Com\smss.exe
  • <SYSTEM32>\Com\netcfg.dll
  • <SYSTEM32>\Com\netcfg.000
Sets the 'hidden' attribute to the following files:
  • C:\AUTORUN.INF
  • <SYSTEM32>\dnsq.dll
  • C:\pagefile.pif
  • <Drive name for removable media>:\pagefile.pif
  • <Drive name for removable media>:\AUTORUN.INF
  • C:\037589.log
  • <SYSTEM32>\Com\smss.exe
  • C:\NetApi000.sys
  • <SYSTEM32>\Com\netcfg.000
  • <SYSTEM32>\Com\lsass.exe
  • <SYSTEM32>\Com\netcfg.dll
Deletes the following files:
  • %TEMP%\RarSFX0\Setup.exe
  • C:\NetApi000.sys
Miscellaneous:
Searches for the following windows:
  • ClassName: 'fg' WindowName: 'gg'
  • ClassName: 'gg' WindowName: 'ff'
  • ClassName: '#32770' WindowName: 'MCI Program Com Application'
  • ClassName: 'XOR' WindowName: 'MSICTFIME SMSS'
  • ClassName: 'dd' WindowName: 'gg'
  • ClassName: '' WindowName: '????'
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'EDIT' WindowName: ''
  • ClassName: 'XOR' WindowName: 'MSCTFIME SMSS'
  • ClassName: '' WindowName: '@@????'
  • ClassName: '' WindowName: 'SREng ????'