FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Win32.HLLW.Autoruner.56776

Added to the Dr.Web virus database: 2011-08-22

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\InternetExplorer\iexplore.exe" -nohome'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.exe] 'Debugger' = 'ntsd -d'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = '<DRIVERS>\TXPlatform.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'Debugger' = 'ntsd -d'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'Debugger' = 'ntsd -d'
Creates the following files on removable media:
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\ЎЎЎЎЎЎ.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
Creates and executes the following:
  • <DRIVERS>\TXPlatform.exe 
Executes the following:
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del75$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del60$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del52$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del95$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del13$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del91$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del79$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del10$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del21$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del76$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del87$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del48$$.bat"
  • <SYSTEM32>\net1.exe share Z$ /del /y
  • <SYSTEM32>\net1.exe share D$ /del /y
  • <SYSTEM32>\net1.exe share C$ /del /y
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del44$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del35$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del26$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del69$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del58$$.bat"
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del25$$.bat"
  • <SYSTEM32>\net1.exe share A$ /del /y
  • <SYSTEM32>\net1.exe share admin$ /del /y
  • <SYSTEM32>\cmd.exe /c "%TEMP%\del12$$.bat"
Terminates or attempts to terminate
the following user processes:
  • AVP.EXE
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\Desk_top_.ini
  • %TEMP%\del75$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\Desk_top_.ini
  • %TEMP%\del91$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\Desk_top_.ini
  • %TEMP%\del60$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\Desk_top_.ini
  • %TEMP%\del58$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\Desk_top_.ini
  • %TEMP%\del12$$.bat
  • %TEMP%\del69$$.bat
  • %TEMP%\del13$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\Desk_top_.ini
  • %TEMP%\del25$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\Desk_top_.ini
  • %TEMP%\del95$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\Desk_top_.ini
  • %TEMP%\del79$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\Desk_top_.ini
  • %TEMP%\del21$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\Desk_top_.ini
  • %TEMP%\del10$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\Desk_top_.ini
  • %TEMP%\del52$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\Desk_top_.ini
  • %TEMP%\del76$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\Desk_top_.ini
  • %TEMP%\del87$$.bat
  • %TEMP%\del48$$.bat
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\Desk_top_.ini
  • C:\Far\Addons\Tables\Desk_top_.ini
  • C:\Far\Addons\Tables\Central European\Desk_top_.ini
  • C:\autorun.inf
  • C:\Far\Addons\Shell\Desk_top_.ini
  • C:\ЎЎЎЎЎЎ.exe
  • %TEMP%\del26$$.bat
  • C:\Far\Addons\Tables\Western European\Desk_top_.ini
  • C:\Far\Addons\XLat\Desk_top_.ini
  • C:\Far\Addons\XLat\Russian\Desk_top_.ini
  • C:\Far\Addons\Tables\Cyrillic\Desk_top_.ini
  • C:\Far\Addons\Tables\Cyrillic\E-Mail Double Conversion\Desk_top_.ini
  • C:\Far\Addons\Tables\Hebrew\Desk_top_.ini
  • C:\Far\Addons\SetUp\Desk_top_.ini
  • C:\Far\Desk_top_.ini
  • C:\Far\Addons\Desk_top_.ini
  • C:\Far\Addons\Archivers\Desk_top_.ini
  • <DRIVERS>\TXPlatform.exe
  • C:\go.sys
  • <Current directory>\Desk_top_.ini
  • C:\Far\Addons\Macros\Desk_top_.ini
  • %TEMP%\del44$$.bat
  • %TEMP%\del35$$.bat
  • C:\Far\Addons\Colors\Desk_top_.ini
  • C:\Far\Addons\Colors\Custom Highlighting\Desk_top_.ini
  • C:\Far\Addons\Colors\Default Highlighting\Desk_top_.ini
  • <Auxiliary element>
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\Desk_top_.ini
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1[1].htm
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\Desk_top_.ini
  • %PROGRAM_FILES%\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\Desk_top_.ini
Sets the 'hidden' attribute to the following files:
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\Desk_top_.ini
  • C:\Far\Addons\Tables\Central European\Desk_top_.ini
  • C:\ЎЎЎЎЎЎ.exe
  • C:\Far\Addons\Tables\Desk_top_.ini
  • <Drive name for removable media>:\autorun.inf
  • C:\Far\Addons\Shell\Desk_top_.ini
  • C:\Far\Addons\Tables\Hebrew\Desk_top_.ini
  • C:\Far\Addons\Tables\Western European\Desk_top_.ini
  • C:\Far\Addons\Tables\Cyrillic\E-Mail Double Conversion\Desk_top_.ini
  • C:\autorun.inf
  • C:\Far\Addons\Tables\Cyrillic\Desk_top_.ini
  • C:\Far\Addons\Archivers\Desk_top_.ini
  • C:\Far\Addons\Colors\Desk_top_.ini
  • C:\Far\Addons\Desk_top_.ini
  • <Current directory>\Desk_top_.ini
  • C:\Far\Desk_top_.ini
  • C:\Far\Addons\SetUp\Desk_top_.ini
  • <Drive name for removable media>:\ЎЎЎЎЎЎ.exe
  • C:\Far\Addons\Macros\Desk_top_.ini
  • C:\Far\Addons\Colors\Custom Highlighting\Desk_top_.ini
  • C:\Far\Addons\Colors\Default Highlighting\Desk_top_.ini
  • C:\Far\Addons\XLat\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\skin\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\Desk_top_.ini
  • %PROGRAM_FILES%\Desk_top_.ini
  • C:\Far\Addons\XLat\Russian\Desk_top_.ini
  • <Auxiliary element>
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\Desk_top_.ini
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\Desk_top_.ini
Deletes the following files:
  • C:\go.sys
Network activity:
Connects to:
  • 'www.da###ng08.com':80
  • 'localhost':1077
  • '<Private IP address>':445
  • '<Private IP address>':139
TCP:
HTTP GET requests:
  • www.da###ng08.com/1.htm
  • www.da###ng08.com/down/down.txt
UDP:
  • DNS ASK www.da###ng08.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: '' WindowName: ''
  • ClassName: 'msctls_statusbar32' WindowName: ''