Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLW.Autoruner.49235

Added to the Dr.Web virus database: 2011-05-08

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\2523821056] 'Name' = '%TEMP%\3.tmp'
Malicious functions:
Creates and executes the following:
  • %HOMEPATH%\u.exe 
  • %HOMEPATH%\t.exe 
  • %HOMEPATH%\SRZJ12161Bd3.exe 
Injects code into
the following system processes:
  • <SYSTEM32>\spoolsv.exe
Modifies file system :
Creates the following files:
  • %TEMP%\2.tmp
  • %WINDIR%\Temp\5.tmp
  • %HOMEPATH%\seenui.exe
  • %HOMEPATH%\SRZJ12161Bd3.exe
  • %HOMEPATH%\t.exe
  • %HOMEPATH%\u.exe
Deletes the following files:
  • %TEMP%\3.tmp
Network activity:
Connects to:
  • 'ka####newsmax.in':80
TCP:
HTTP POST requests:
  • ka####newsmax.in/mjicsmjimcjimcsdmc.php?in##############################################################################################################
UDP:
  • DNS ASK sa###force.com
  • DNS ASK ka####newsmax.in
  • DNS ASK ga###pot.com
  • DNS ASK te###raph.co.uk
  • '<Private IP address>':1035