Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLW.Autoruner1.26977

Added to the Dr.Web virus database: 2012-10-03

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCardLogn] 'DllName' = '%WINDIR%\ScNotify.dll'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winsamps' = '%WINDIR%\realupdate.exe other'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\1015.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCardLogn] 'Startup' = 'SCardStartCertProp'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winsamps' = '%WINDIR%\winamps.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'updatereal' = '%WINDIR%\realupdate.exe other'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\kernels88.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '%TEMP%\sna.exe' = '%TEMP%\sna.exe'
Creates the following files on removable media:
  • <Drive name for removable media>:\Autorun.inf
  • <Drive name for removable media>:\oxggm.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
blocks execution of the following system utilities:
  • Windows Task Manager (Taskmgr)
Creates and executes the following:
  • %TEMP%\1015.exe
  • %TEMP%\win32.exe
  • %ALLUSERSPROFILE%\Templates\temp.exe
  • %WINDIR%\realupdate.exe other
  • %TEMP%\bind_50218.exe
  • %TEMP%\4000.exe
  • %TEMP%\sna.exe
  • %TEMP%\okads080.exe
  • %ALLUSERSPROFILE%\Templates\temp.exe (downloaded from the Internet)
Executes the following:
  • <SYSTEM32>\ntvdm.exe -f -i3
  • <SYSTEM32>\ntvdm.exe -f -i2
  • <SYSTEM32>\ntvdm.exe -f -i4
  • <SYSTEM32>\ntvdm.exe -f -i6
  • <SYSTEM32>\ntvdm.exe -f -i5
  • <SYSTEM32>\ntvdm.exe -f -i1
  • <SYSTEM32>\netsh.exe firewall set allowedprogram '%TEMP%\win32.exe' enable
  • <SYSTEM32>\rundll32.exe <SYSTEM32>\{pchome}\.setupf\dllhosts.dll _JustSoSo@16
  • %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://d.##ei.net/power.asp?Id########### 15
  • <SYSTEM32>\rundll32.exe <SYSTEM32>\{pchome}\.setupf\dllhosts.dll _JustSoSo@16 ""
  • <SYSTEM32>\regsvr32.exe "%WINDIR%\POPNTS.DLL" /s
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
  • %TEMP%\5.dllb
  • <SYSTEM32>\dlh9jkd1q5.exe
  • %TEMP%\2.dllb
  • <SYSTEM32>\dlh9jkd1q2.exe
  • <SYSTEM32>\dlh9jkd1q6.exe
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\proxy[1].jpg
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tool[1].jpg
  • %TEMP%\6.dllb
  • <SYSTEM32>\dlh9jkd1q1.exe
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\downurl[1].txt
  • <SYSTEM32>\sbvw.ll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
  • %ALLUSERSPROFILE%\Templates\temp.exe
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\null[1].jpg
  • %TEMP%\1.dllb
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\sdgferg3rge4rgerfgg[1].php
  • <SYSTEM32>\dlh9jkd1q8.exe
  • %WINDIR%\Temp\scs9.tmp
  • %WINDIR%\Temp\scsA.tmp
  • %WINDIR%\Temp\scs8.tmp
  • %WINDIR%\Temp\scs7.tmp
  • %WINDIR%\Temp\scsD.tmp
  • %WINDIR%\Temp\scsE.tmp
  • %WINDIR%\Temp\scsB.tmp
  • %WINDIR%\Temp\scsC.tmp
  • %WINDIR%\Temp\scs6.tmp
  • %WINDIR%\Temp\scs4.tmp
  • %WINDIR%\Temp\scs3.tmp
  • %TEMP%\7.dllb
  • <SYSTEM32>\dlh9jkd1q7.exe
  • %TEMP%\3.dllb
  • <SYSTEM32>\vx.tll
  • %WINDIR%\Temp\scs5.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adv114[1].php
  • <SYSTEM32>\{pchome}\.setupf\libverx.dat.tmp
  • <SYSTEM32>\{pchome}\.setupf\verx.dat
  • <SYSTEM32>\{pchome}\.setupf\libup.dat.tmp
  • <SYSTEM32>\{pchome}\.setupf\up.dat
  • <SYSTEM32>\{pchome}\.setupf\libwinamps.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\winamps.exe
  • <SYSTEM32>\{pchome}\.setupf\libnovel.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\novel.exe
  • <SYSTEM32>\{pchome}\.setupf\setup.tmp
  • %TEMP%\win32.exe
  • %TEMP%\bind_50218.exe
  • %TEMP%\nsb2.tmp
  • %TEMP%\4000.exe
  • %TEMP%\1015.exe
  • <SYSTEM32>\{pchome}\.setupf\avps.exe
  • %TEMP%\okads080.exe
  • %TEMP%\sna.exe
  • <SYSTEM32>\wbem\sholl32.dll
  • <SYSTEM32>\kernels88.exe
  • %WINDIR%\winamps.exe
  • %WINDIR%\realupdate.exe
  • %WINDIR%\saslogww.txt
  • %WINDIR%\1015.exe
  • %WINDIR%\POPNTS.DLL
  • %WINDIR%\ScNotify.dll
  • <SYSTEM32>\{pchome}\.setupf\lib
  • <SYSTEM32>\{pchome}\.setupf\libp.tmp.tmp
  • <SYSTEM32>\{pchome}\.setupf\p.tmp
  • <SYSTEM32>\{pchome}\.setupf\librealupdate.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\realupdate.exe
  • <SYSTEM32>\{pchome}\.setupf\libdllhosts.dll.tmp
  • <SYSTEM32>\{pchome}\.setupf\dllhosts.dll
  • <SYSTEM32>\{pchome}\.setupf\libPOPNTS.DLL.tmp
  • <SYSTEM32>\{pchome}\.setupf\POPNTS.DLL
Sets the 'hidden' attribute to the following files:
  • %WINDIR%\1015.exe
  • <Drive name for removable media>:\oxggm.exe
Deletes the following files:
  • %WINDIR%\Temp\scs8.tmp
  • %WINDIR%\Temp\scs4.tmp
  • %WINDIR%\Temp\scs6.tmp
  • %WINDIR%\Temp\scs5.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tool[1].jpg
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\null[1].jpg
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adv114[1].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\proxy[1].jpg
  • %WINDIR%\Temp\scsC.tmp
  • %WINDIR%\Temp\scs9.tmp
  • %WINDIR%\Temp\scsE.tmp
  • %WINDIR%\Temp\scsA.tmp
  • %WINDIR%\Temp\scs7.tmp
  • %WINDIR%\Temp\scs3.tmp
  • %WINDIR%\Temp\scsD.tmp
  • %WINDIR%\Temp\scsB.tmp
  • <SYSTEM32>\{pchome}\.setupf\libp.tmp.tmp
  • <SYSTEM32>\{pchome}\.setupf\librealupdate.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\libdllhosts.dll.tmp
  • <SYSTEM32>\{pchome}\.setupf\libPOPNTS.DLL.tmp
  • <SYSTEM32>\{pchome}\.setupf\libverx.dat.tmp
  • <SYSTEM32>\{pchome}\.setupf\libup.dat.tmp
  • <SYSTEM32>\{pchome}\.setupf\libwinamps.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\libnovel.exe.tmp
  • <SYSTEM32>\{pchome}\.setupf\setup.tmp
  • <SYSTEM32>\{pchome}\.setupf\lib
  • <SYSTEM32>\sbvw.ll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
  • <SYSTEM32>\{pchome}\.setupf\realupdate.exe
  • <SYSTEM32>\{pchome}\.setupf\winamps.exe
  • <SYSTEM32>\{pchome}\.setupf\p.tmp
  • <SYSTEM32>\{pchome}\.setupf\POPNTS.DLL
Network activity:
Connects to:
  • 'localhost':1046
  • 'localhost':1044
  • 'pr###dtraf.biz':80
  • '20#.#6.232.182':80
  • 'se###2.tqzn.com':80
  • 'localhost':1037
  • 'localhost':1043
  • 'up###.j7y.net':80
TCP:
HTTP GET requests:
  • pr###dtraf.biz/pic/tool.jpg
  • pr###dtraf.biz/pic/proxy.jpg
  • pr###dtraf.biz/sgfhergfjherfghejrgfvbdngg/adv114.php?ad####################################
  • pr###dtraf.biz/pic/null.jpg
  • se###2.tqzn.com/barbindsoft/barsetup.exe?qu###########
  • up###.j7y.net/upcfg/downurl.txt
  • pr###dtraf.biz/sdgferg3rge4rgerfgg.php?ad###########################
UDP:
  • DNS ASK d.##ei.net
  • DNS ASK www.microsoft.com
  • DNS ASK pr###dtraf.biz
  • DNS ASK se###2.tqzn.com
  • DNS ASK up###.j7y.net
Miscellaneous:
Searches for the following windows:
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dac.db4.3a0005'
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d9c.da4.390002'
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc8.dcc.3b0006'
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-de0.de4.3d0008'
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dd0.dd8.3c0007'
  • ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d94.d98.380001'
  • ClassName: '' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''