FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLW.Autohit.18799

Added to the Dr.Web virus database: 2020-11-09

Virus description added:

Technical Information

To ensure autorun and distribution
Creates or modifies the following files
  • %APPDATA%\microsoft\windows\start menu\programs\startup\microsoft update.lnk
Modifies file system
Creates the following files
  • %TEMP%\aut6882.tmp
  • %TEMP%\zicieoc
  • %TEMP%\aut691f.tmp
  • %TEMP%\pwibpe.pdf
  • %TEMP%\skyp\server.exe
Deletes the following files
  • %TEMP%\aut6882.tmp
  • %TEMP%\zicieoc
  • %TEMP%\aut691f.tmp
Network activity
Connects to
  • '<LOCALNET>.110.14':4445
Miscellaneous
Executes the following
  • '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\PWIBPE.pdf"

Dr.Web © Doctor Web
2003 — 2022

Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.