JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner.56661
Added to the Dr.Web virus database:
2011-08-19
Virus description added:
2011-08-20
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Downloader' = '"%TEMP%\startup.exe"'
Creates the following files on removable media:
<Drive name for removable media>:\SysPro.exe
<Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
User Account Control (UAC)
Executes the following:
<SYSTEM32>\wscript.exe "%TEMP%\DofusMod.vbs"
Terminates or attempts to terminate
the following user processes:
bdagent.exe
zlclient.exe
AVP.EXE
outpost.exe
Modifies file system :
Creates the following files:
%TEMP%\exiterreur2.png
%TEMP%\exitdofus2.png
%TEMP%\exit1.png
%TEMP%\options1.png
%TEMP%\exitdofus1.png
%TEMP%\croix2.png
%TEMP%\croix1.png
%TEMP%\decoche.png
%TEMP%\exiterreur1.png
%TEMP%\exit2.png
%TEMP%\fleche1.png
%TEMP%\parrainage1.png
%TEMP%\options2.png
%TEMP%\parrainage2.png
%TEMP%\star2.png
%TEMP%\star1.png
%TEMP%\Jouer2.png
%TEMP%\fleche2.png
%TEMP%\Jouer1.png
%TEMP%\ok1.png
%TEMP%\ok2.png
<DRIVERS>\svchost.exe
<SYSTEM32>\dllcache\doc.pif
%TEMP%\DofusMod.vbs
%TEMP%\startup.exe
%TEMP%\DofusMod.exe
C:\autorun.inf
%TEMP%\Downloader.exe
C:\SysPro.exe
<SYSTEM32>\dllcache\myporn.scr
<SYSTEM32>\dllcache\recycled.exe
%TEMP%\25boss.png
%TEMP%\avantage2.png
%TEMP%\avantage1.png
%TEMP%\coche.png
%TEMP%\config2.png
%TEMP%\config1.png
%TEMP%\64boss.png
%TEMP%\50boss.png
%TEMP%\77boss.png
%TEMP%\annuler2.png
%TEMP%\annuler1.png
Sets the 'hidden' attribute to the following files:
C:\SysPro.exe
C:\autorun.inf
Deletes the following files:
Network activity:
Connects to:
'as####27.herobo.com':80
'dl.##opbox.com':80
TCP:
HTTP GET requests:
as####27.herobo.com/options1.png
as####27.herobo.com/exitdofus1.png
as####27.herobo.com/fleche2.png
as####27.herobo.com/fleche1.png
as####27.herobo.com/exitdofus2.png
as####27.herobo.com/exiterreur1.png
as####27.herobo.com/exit1.png
as####27.herobo.com/exiterreur2.png
as####27.herobo.com/Jouer2.png
as####27.herobo.com/parrainage2.png
as####27.herobo.com/parrainage1.png
as####27.herobo.com/star2.png
as####27.herobo.com/star1.png
as####27.herobo.com/ok2.png
as####27.herobo.com/Jouer1.png
as####27.herobo.com/options2.png
as####27.herobo.com/ok1.png
as####27.herobo.com/exit2.png
as####27.herobo.com/64boss.png
as####27.herobo.com/50boss.png
as####27.herobo.com/annuler1.png
as####27.herobo.com/77boss.png
dl.##opbox.com/u/27365203/dofusmod-autodestruction.exe
dl.##opbox.com/u/27365203/DofusMod.vbs
as####27.herobo.com/25boss.png
dl.##opbox.com/u/27365203/downloader-startup.exe
as####27.herobo.com/annuler2.png
as####27.herobo.com/croix1.png
as####27.herobo.com/config2.png
as####27.herobo.com/decoche.png
as####27.herobo.com/croix2.png
as####27.herobo.com/avantage2.png
as####27.herobo.com/avantage1.png
as####27.herobo.com/config1.png
as####27.herobo.com/coche.png
UDP:
DNS ASK as####27.herobo.com
DNS ASK dl.##opbox.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Indicator' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK