JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner1.53999
Added to the Dr.Web virus database:
2013-08-14
Virus description added:
2013-08-15
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qq.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE] 'debugger' = '<SYSTEM32>\item.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvp.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorerexe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe] 'debugger' = '<SYSTEM32>\item.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\service.msc] 'debugger' = '<SYSTEM32>\item.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acdsee.EXE] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IExplorer.exe] 'debugger' = '<SYSTEM32>\item.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'debugger' = '<SYSTEM32>\item.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'winupdate' = '<SYSTEM32>\usbsetdll.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\usbset.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\usbsetdll.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winupdate' = '<SYSTEM32>\usbsetdll.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegSrvc.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flash.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'debugger' = '1'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
Creates the following files on removable media:
<Drive name for removable media>:\AutoRun.inf
Malicious functions:
Executes the following:
'<SYSTEM32>\attrib.exe' /pid=3068
'<SYSTEM32>\attrib.exe' -p 2060 -e 128 -g
'<SYSTEM32>\attrib.exe' /pid=3228
'<SYSTEM32>\attrib.exe' /pid=4072
'<SYSTEM32>\attrib.exe' /pid=4080
'<SYSTEM32>\attrib.exe' /pid=3992
'<SYSTEM32>\attrib.exe' /pid=3056
'<SYSTEM32>\attrib.exe' -p 3384 -e 128 -g
'<SYSTEM32>\attrib.exe' /pid=2064
'<SYSTEM32>\attrib.exe' A:\????.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' /pid=3900
'<SYSTEM32>\attrib.exe' /pid=1720
'<SYSTEM32>\attrib.exe' /pid=3000
'<SYSTEM32>\attrib.exe' /pid=2604
'<SYSTEM32>\attrib.exe' /pid=2660
'<SYSTEM32>\attrib.exe' /pid=2808
'<SYSTEM32>\attrib.exe' /pid=328
'<SYSTEM32>\attrib.exe' /pid=2912
'<SYSTEM32>\attrib.exe' /pid=3260
'<SYSTEM32>\attrib.exe' /pid=2964
'<SYSTEM32>\attrib.exe' /pid=3724
'<SYSTEM32>\attrib.exe' /pid=2872
'<SYSTEM32>\attrib.exe' /pid=240
'<SYSTEM32>\attrib.exe' C:\????.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' /pid=3784
'<SYSTEM32>\attrib.exe' /pid=2836
'<SYSTEM32>\attrib.exe' /pid=2852
'<SYSTEM32>\attrib.exe' C:\AutoRun.inf +h +s +r +a
'<SYSTEM32>\attrib.exe' A:\AutoRun.inf +h +s +r +a
'<SYSTEM32>\attrib.exe' <SYSTEM32>\usbsetdll.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' Z:\????.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' <Drive name for removable media>:\AutoRun.ini +h +s +r +a
'<SYSTEM32>\attrib.exe' %ALLUSERSPROFILE%\??????\??\??\usbsetdll.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' Z:\AutoRun.ini +h +s +r +a
'<SYSTEM32>\attrib.exe' E:\AutoRun.inf +h +s +r +a
'<SYSTEM32>\attrib.exe' <Drive name for removable media>:\AutoRun.inf +h +s +r +a
'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\dllls.bat
'<SYSTEM32>\attrib.exe' E:\AutoRun.ini +h +s +r +a
'<SYSTEM32>\attrib.exe' C:\AutoRun.ini +h +s +r +a
'<SYSTEM32>\attrib.exe' Z:\AutoRun.inf +h +s +r +a
'<SYSTEM32>\attrib.exe' A:\AutoRun.ini +h +s +r +a
'<SYSTEM32>\attrib.exe' /pid=3856
'<SYSTEM32>\attrib.exe' /pid=3864
'<SYSTEM32>\attrib.exe' /pid=3828
'<SYSTEM32>\attrib.exe' /pid=3980
'<SYSTEM32>\attrib.exe' /pid=3956
'<SYSTEM32>\attrib.exe' /pid=3912
'<SYSTEM32>\attrib.exe' /pid=3800
'<SYSTEM32>\attrib.exe' E:\????.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' /c <SYSTEM32>\dllls.bat
'<SYSTEM32>\attrib.exe' <Drive name for removable media>:\????.exe +h +s +r +a
'<SYSTEM32>\attrib.exe' /pid=3772
'<SYSTEM32>\attrib.exe' /pid=3756
'<SYSTEM32>\attrib.exe' /pid=3744
Injects code into
the following system processes:
Modifies file system :
Creates the following files:
<SYSTEM32>\dllls.bat
C:\AutoRun.inf
<SYSTEM32>\usbsetdll.exe
Sets the 'hidden' attribute to the following files:
<SYSTEM32>\usbsetdll.exe
<Drive name for removable media>:\AutoRun.inf
Deletes the following files:
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK