Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLW.Autoruner1.29364

Added to the Dr.Web virus database: 2012-11-06

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mt' = '<SYSTEM32>\vaillo.exe'
Creates the following files on removable media:
  • <Drive name for removable media>:\Images.exe
  • <Drive name for removable media>:\System.exe
  • <Drive name for removable media>:\vaillo.exe
  • <Drive name for removable media>:\Sounds.exe
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\Videos.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
  • file extensions
Executes the following:
  • <SYSTEM32>\attrib.exe +r +h +s e:\autorun.inf
  • <SYSTEM32>\attrib.exe +r +h +s z:\autorun.inf
  • <SYSTEM32>\reg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v mt /t REG_SZ /d <SYSTEM32>\vaillo.exe /f
  • <SYSTEM32>\attrib.exe +r +h +s c:\autorun.inf
  • <SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /V ShowSuperHidden /t REG_DWORD /D 0 /f
  • <SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /V HideFileExt /t REG_DWORD /d 1 /f
  • <SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /V Hidden /t REG_DWORD /d 0 /f
Modifies file system :
Creates the following files:
  • <SYSTEM32>\Revo.exe
  • <SYSTEM32>\steb.exe
  • <SYSTEM32>\Viva.exe
  • <SYSTEM32>\Smash.exe
  • <SYSTEM32>\Click.exe
  • <SYSTEM32>\Honda.exe
  • <SYSTEM32>\chalie.exe
  • <SYSTEM32>\Fino.exe
  • C:\Images.exe
  • C:\Videos.exe
  • C:\vaillo.exe
  • C:\System.exe
  • %WINDIR%\system\oeminfo.ini
  • %WINDIR%\system\drver.cab.sys
  • C:\autorun.inf
  • C:\Sounds.exe
  • <SYSTEM32>\Heaven.exe
  • %WINDIR%\freesex.exe
  • %WINDIR%\Kenel32.exe
  • %WINDIR%\taskes.exe
  • <SYSTEM32>.exe
  • <SYSTEM32>\vaillo.exe
  • %TEMP%\a67498.bat
  • %WINDIR%\Help\KGC.exe
  • %WINDIR%\Fonts\limons.ttf
  • <SYSTEM32>\God.exe
  • %WINDIR%\Media\soundsman.exe
  • <SYSTEM32>\War.exe
  • <SYSTEM32>\Of.exe
  • %WINDIR%\system\driber.exe
  • %WINDIR%\suck.exe
  • %WINDIR%\Web\GameKhmer.exe
  • %WINDIR%\Web\Wallpapers.exe
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\autorun.inf
  • C:\autorun.inf
  • %TEMP%\a67498.bat
The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124