JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner1.45803
Added to the Dr.Web virus database:
2013-07-11
Virus description added:
2013-07-11
Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'winlogon' = 'C:\heap41a\svchost.exe C:\heap41a\std.txt'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'status' = 'present'
Creates the following files on removable media:
<Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
Creates and executes the following:
'C:\heap41a\svchost.exe' C:\heap41a\script1.txt
'C:\heap41a\svchost.exe' C:\heap41a\reproduce.txt
'%TEMP%\MicrosoftPowerPoint\svchost.exe' MicrosoftPowerPoint\install.txt
'C:\heap41a\svchost.exe' C:\heap41a\std.txt
Modifies file system :
Creates the following files:
C:\heap41a\Icon.ico
C:\heap41a\2.mp3
C:\heap41a\drivelist.txt
C:\heap41a\offspring\autorun.inf
C:\heap41a\script1.txt
C:\heap41a\std.txt
C:\heap41a\reproduce.txt
%TEMP%\MicrosoftPowerPoint\pathlist.txt
%TEMP%\MicrosoftPowerPoint\Install.txt
%TEMP%\MicrosoftPowerPoint\drivelist.txt
%TEMP%\MicrosoftPowerPoint\svchost.exe
C:\heap41a\svchost.exe
%TEMP%\MicrosoftPowerPoint\2.mp3
%TEMP%\MicrosoftPowerPoint\Icon.ico
Sets the 'hidden' attribute to the following files:
C:\heap41a\offspring\autorun.inf
Miscellaneous:
Searches for the following windows:
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\script1.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\reproduce.txt - AutoHotkey v1.0.46.08'
ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\std.txt - AutoHotkey v1.0.46.08'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK