FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.MyDoom.19.origin

Added to the Dr.Web virus database: 2020-11-09

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Traybar' = '%WINDIR%\lsass.exe'
Modifies file system
Creates the following files
  • %WINDIR%\lsass.exe
  • %TEMP%\l4sqtij.txt
Network activity
Connects to
  • '19#.#8.16.14':1042
  • '68.##5.239.46':1042
  • '16.##.196.203':1042
Miscellaneous
Searches for the following windows
  • ClassName: 'rctrl_renwnd32' WindowName: ''
  • ClassName: 'ATH_Note' WindowName: ''
  • ClassName: 'IEFrame' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
  • '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"

Dr.Web © Doctor Web
2003 — 2022

Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.