JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner2.53029
Added to the Dr.Web virus database:
2019-07-22
Virus description added:
2019-07-24
Technical Information
To ensure autorun and distribution
Modifies the following registry keys
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, wscript.exe //B "%TEMP%\System\smss-DoOoMs.vbs"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,wscript.exe //B "%TEMP%\System\smss-DoOoMs.vbs"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles% (x86)\Skype\Phone\Skype.exe" /minimized /regrun, wscript.exe //B "%TEMP%\\Media Player\smss-DoOoMp.lnk"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles%\Skype\Phone\Skype.exe" /minimized /regrun, wscript.exe //B "%TEMP%\\Media Player\smss-DoOoMp.lnk"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoMs' = '"%TEMP%\Media Player\smss-DoOoMp.lnk"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoM' = '"%TEMP%\Media Player\smss-DoOoM.lnk"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoM' = '"%TEMP%\Media Player\smss-DoOoM.lnk"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoMs' = '"%TEMP%\Media Player\smss-DoOoMp.lnk"'
Creates or modifies the following files
%HOMEPATH%\start menu\programs\startup\smss-dooom.lnk
%HOMEPATH%\start menu\programs\startup\smss-doooms.lnk
Creates the following files on removable media
<Drive name for removable media>:\correct.avi.lnk
<Drive name for removable media>:\movies.lnk
<Drive name for removable media>:\pictures.lnk
<Drive name for removable media>:\videos.lnk
<Drive name for removable media>:\tcm851ax32.exe.lnk
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe.lnk
<Drive name for removable media>:\notepad.exe.lnk
<Drive name for removable media>:\utorrent.exe.lnk
<Drive name for removable media>:\holycrosschurchinstructions.docx.lnk
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.lnk
<Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
<Drive name for removable media>:\games.lnk
<Drive name for removable media>:\sdszfo.docx.lnk
<Drive name for removable media>:\fi51.doc.lnk
<Drive name for removable media>:\applicantform_en.doc.lnk
<Drive name for removable media>:\contoso.cer.lnk
<Drive name for removable media>:\testee.cer.lnk
<Drive name for removable media>:\contosoroot.cer.lnk
<Drive name for removable media>:\contoso_1.cer.lnk
<Drive name for removable media>:\dashborder_96.bmp.lnk
<Drive name for removable media>:\split.avi.lnk
<Drive name for removable media>:\000814251_video_01.avi.lnk
<Drive name for removable media>:\delete.avi.lnk
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
<Drive name for removable media>:\dcim.lnk
Modifies file system
Creates the following files
%TEMP%\media player\smss-dooomp.lnk
%TEMP%\smss-dooom-privacy\smss-dooom.vbe
%TEMP%\system\smss-doooms.vbs
%TEMP%\smss-dooom-service\smss-doooms.vbe
%TEMP%\media player\smss-dooom.lnk
Network activity
UDP
DNS ASK ja#####017.myq-see.com
Miscellaneous
Creates and executes the following
'<SYSTEM32>\schtasks.exe' /create /sc ONLOGON /RL HIGHEST /tn smss-DoOoM.vbe /tr "%TEMP%\System\smss-DoOoMs.vbs"' (with hidden window)
Executes the following
'<SYSTEM32>\schtasks.exe' /create /sc ONLOGON /RL HIGHEST /tn smss-DoOoM.vbe /tr "%TEMP%\System\smss-DoOoMs.vbs"
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK