JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner2.24132
Added to the Dr.Web virus database:
2016-05-23
Virus description added:
2016-05-23
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%HOMEPATH%\aegvvp.exe'
Malicious functions:
Executes the following:
Injects code into
the following system processes:
Modifies file system:
Creates the following files:
Sets the 'hidden' attribute to the following files:
Network activity:
UDP:
DNS ASK mu###.###tal-protection.net.ru
DNS ASK sl###.##fehousenumber.com
'mu###.###tal-protection.net.ru':27001
'sl###.##fehousenumber.com':27001
Miscellaneous:
Searches for the following windows:
ClassName: 'Ladetf' WindowName: 'Blarguobi. Xgv X, Bgfxi Vtij'
ClassName: 'Xylokd Sttoi Nmnw' WindowName: 'Srovfl, Smxh, Droe'
ClassName: 'Bgfxi Vtij, Ladetf' WindowName: 'Blarguobi. Xgv X'
ClassName: 'Xexwsqtybk, Ywy. Fn' WindowName: 'Yxmxtpx Eoqf Tjic'
ClassName: 'Ywy. Fn' WindowName: 'Yxmxtpx Eoqf Tjic, Xexwsqtybk'
ClassName: 'Docpkixgy. Vtklwcn' WindowName: 'Ihjnau Fq, Xtadt'
ClassName: 'Dddfmut' WindowName: 'Opliatde Rifpd Ufv, Afspg Lbie'
ClassName: 'Qwrjysakl Jeggqkfqf' WindowName: 'Ycgrruv Lrwvybtx'
ClassName: 'Afspg Lbie, Dddfmut' WindowName: 'Opliatde Rifpd Ufv'
ClassName: 'Renpja, Uoj, Mkq' WindowName: 'Fqyoabm Qgp Tarrn'
ClassName: 'Mkq' WindowName: 'Fqyoabm Qgp Tarrn, Renpja, Uoj'
ClassName: 'Xku. Lucwr Djsbf Q' WindowName: 'Ydre Kvtglcxfpi'
ClassName: 'Njv. Ynymn' WindowName: 'Swnyxe Xysxs Fdjt, Lwspx'
ClassName: 'Kxhbfk Gfilfw E' WindowName: 'Flq, Ttxn Umpola'
ClassName: 'Lwspx, Njv. Ynymn' WindowName: 'Swnyxe Xysxs Fdjt'
ClassName: 'Rasglud Hvutpin' WindowName: 'Cvjdflok Opiqkp'
ClassName: 'Vybin. Plm Prybnahd' WindowName: 'Ypdtucog Mviy R'
ClassName: 'Lctlb Uth. Vvxjnj' WindowName: 'Sejbbd Rtwdd Aopehq'
ClassName: 'Arccuj. Lrju Eeijnl' WindowName: 'Heoqjb Bedbol. Spmx'
ClassName: 'Kemmiik Dvrtrhjkm' WindowName: 'Siecoak Jtdmhprrg L'
ClassName: 'Mhvrgvq Fyab. Nn' WindowName: 'Raiioamy, Praxqsd R'
ClassName: 'Ofajwxlq Wsrmgh. Ph' WindowName: 'Fjjspuj Apsmduj Sr'
ClassName: 'Vhqq. Fmewska Yi' WindowName: 'Lnvgd. Fv, Onxi J'
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK