Win32.HLLW.Autoruner1.26977

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCardLogn] 'DllName' = '%WINDIR%\ScNotify.dll'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winsamps' = '%WINDIR%\realupdate.exe other'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\1015.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCardLogn] 'Startup' = 'SCardStartCertProp'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winsamps' = '%WINDIR%\winamps.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'updatereal' = '%WINDIR%\realupdate.exe other'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\kernels88.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '%TEMP%\sna.exe' = '%TEMP%\sna.exe'

Creates the following files on removable media:

<Drive name for removable media>:\Autorun.inf
<Drive name for removable media>:\oxggm.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Creates and executes the following:

%TEMP%\1015.exe
%TEMP%\win32.exe
%ALLUSERSPROFILE%\Templates\temp.exe
%WINDIR%\realupdate.exe other
%TEMP%\bind_50218.exe
%TEMP%\4000.exe
%TEMP%\sna.exe
%TEMP%\okads080.exe
%ALLUSERSPROFILE%\Templates\temp.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\ntvdm.exe -f -i3
<SYSTEM32>\ntvdm.exe -f -i2
<SYSTEM32>\ntvdm.exe -f -i4
<SYSTEM32>\ntvdm.exe -f -i6
<SYSTEM32>\ntvdm.exe -f -i5
<SYSTEM32>\ntvdm.exe -f -i1
<SYSTEM32>\netsh.exe firewall set allowedprogram '%TEMP%\win32.exe' enable
<SYSTEM32>\rundll32.exe <SYSTEM32>\{pchome}\.setupf\dllhosts.dll _JustSoSo@16
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://d.##ei.net/power.asp?Id########### 15
<SYSTEM32>\rundll32.exe <SYSTEM32>\{pchome}\.setupf\dllhosts.dll _JustSoSo@16 ""
<SYSTEM32>\regsvr32.exe "%WINDIR%\POPNTS.DLL" /s

Forces autoplay for removable media.

Modifies file system :

Creates the following files:

%TEMP%\5.dllb
<SYSTEM32>\dlh9jkd1q5.exe
%TEMP%\2.dllb
<SYSTEM32>\dlh9jkd1q2.exe
<SYSTEM32>\dlh9jkd1q6.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\proxy[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tool[1].jpg
%TEMP%\6.dllb
<SYSTEM32>\dlh9jkd1q1.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\downurl[1].txt
<SYSTEM32>\sbvw.ll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
%ALLUSERSPROFILE%\Templates\temp.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\null[1].jpg
%TEMP%\1.dllb
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\sdgferg3rge4rgerfgg[1].php
<SYSTEM32>\dlh9jkd1q8.exe
%WINDIR%\Temp\scs9.tmp
%WINDIR%\Temp\scsA.tmp
%WINDIR%\Temp\scs8.tmp
%WINDIR%\Temp\scs7.tmp
%WINDIR%\Temp\scsD.tmp
%WINDIR%\Temp\scsE.tmp
%WINDIR%\Temp\scsB.tmp
%WINDIR%\Temp\scsC.tmp
%WINDIR%\Temp\scs6.tmp
%WINDIR%\Temp\scs4.tmp
%WINDIR%\Temp\scs3.tmp
%TEMP%\7.dllb
<SYSTEM32>\dlh9jkd1q7.exe
%TEMP%\3.dllb
<SYSTEM32>\vx.tll
%WINDIR%\Temp\scs5.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adv114[1].php
<SYSTEM32>\{pchome}\.setupf\libverx.dat.tmp
<SYSTEM32>\{pchome}\.setupf\verx.dat
<SYSTEM32>\{pchome}\.setupf\libup.dat.tmp
<SYSTEM32>\{pchome}\.setupf\up.dat
<SYSTEM32>\{pchome}\.setupf\libwinamps.exe.tmp
<SYSTEM32>\{pchome}\.setupf\winamps.exe
<SYSTEM32>\{pchome}\.setupf\libnovel.exe.tmp
<SYSTEM32>\{pchome}\.setupf\novel.exe
<SYSTEM32>\{pchome}\.setupf\setup.tmp
%TEMP%\win32.exe
%TEMP%\bind_50218.exe
%TEMP%\nsb2.tmp
%TEMP%\4000.exe
%TEMP%\1015.exe
<SYSTEM32>\{pchome}\.setupf\avps.exe
%TEMP%\okads080.exe
%TEMP%\sna.exe
<SYSTEM32>\wbem\sholl32.dll
<SYSTEM32>\kernels88.exe
%WINDIR%\winamps.exe
%WINDIR%\realupdate.exe
%WINDIR%\saslogww.txt
%WINDIR%\1015.exe
%WINDIR%\POPNTS.DLL
%WINDIR%\ScNotify.dll
<SYSTEM32>\{pchome}\.setupf\lib
<SYSTEM32>\{pchome}\.setupf\libp.tmp.tmp
<SYSTEM32>\{pchome}\.setupf\p.tmp
<SYSTEM32>\{pchome}\.setupf\librealupdate.exe.tmp
<SYSTEM32>\{pchome}\.setupf\realupdate.exe
<SYSTEM32>\{pchome}\.setupf\libdllhosts.dll.tmp
<SYSTEM32>\{pchome}\.setupf\dllhosts.dll
<SYSTEM32>\{pchome}\.setupf\libPOPNTS.DLL.tmp
<SYSTEM32>\{pchome}\.setupf\POPNTS.DLL

Sets the 'hidden' attribute to the following files:

%WINDIR%\1015.exe
<Drive name for removable media>:\oxggm.exe

Deletes the following files:

%WINDIR%\Temp\scs8.tmp
%WINDIR%\Temp\scs4.tmp
%WINDIR%\Temp\scs6.tmp
%WINDIR%\Temp\scs5.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tool[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\null[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adv114[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\proxy[1].jpg
%WINDIR%\Temp\scsC.tmp
%WINDIR%\Temp\scs9.tmp
%WINDIR%\Temp\scsE.tmp
%WINDIR%\Temp\scsA.tmp
%WINDIR%\Temp\scs7.tmp
%WINDIR%\Temp\scs3.tmp
%WINDIR%\Temp\scsD.tmp
%WINDIR%\Temp\scsB.tmp
<SYSTEM32>\{pchome}\.setupf\libp.tmp.tmp
<SYSTEM32>\{pchome}\.setupf\librealupdate.exe.tmp
<SYSTEM32>\{pchome}\.setupf\libdllhosts.dll.tmp
<SYSTEM32>\{pchome}\.setupf\libPOPNTS.DLL.tmp
<SYSTEM32>\{pchome}\.setupf\libverx.dat.tmp
<SYSTEM32>\{pchome}\.setupf\libup.dat.tmp
<SYSTEM32>\{pchome}\.setupf\libwinamps.exe.tmp
<SYSTEM32>\{pchome}\.setupf\libnovel.exe.tmp
<SYSTEM32>\{pchome}\.setupf\setup.tmp
<SYSTEM32>\{pchome}\.setupf\lib
<SYSTEM32>\sbvw.ll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\barsetup[1]
<SYSTEM32>\{pchome}\.setupf\realupdate.exe
<SYSTEM32>\{pchome}\.setupf\winamps.exe
<SYSTEM32>\{pchome}\.setupf\p.tmp
<SYSTEM32>\{pchome}\.setupf\POPNTS.DLL

Network activity:

Connects to:

'localhost':1046
'localhost':1044
'pr###dtraf.biz':80
'20#.#6.232.182':80
'se###2.tqzn.com':80
'localhost':1037
'localhost':1043
'up###.j7y.net':80

TCP:

HTTP GET requests:

pr###dtraf.biz/pic/tool.jpg
pr###dtraf.biz/pic/proxy.jpg
pr###dtraf.biz/sgfhergfjherfghejrgfvbdngg/adv114.php?ad####################################
pr###dtraf.biz/pic/null.jpg
se###2.tqzn.com/barbindsoft/barsetup.exe?qu###########
up###.j7y.net/upcfg/downurl.txt
pr###dtraf.biz/sdgferg3rge4rgerfgg.php?ad###########################

UDP:

DNS ASK d.##ei.net
DNS ASK www.microsoft.com
DNS ASK pr###dtraf.biz
DNS ASK se###2.tqzn.com
DNS ASK up###.j7y.net

Miscellaneous:

Searches for the following windows:

ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dac.db4.3a0005'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d9c.da4.390002'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc8.dcc.3b0006'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-de0.de4.3d0008'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dd0.dd8.3c0007'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d94.d98.380001'
ClassName: '' WindowName: ''
ClassName: 'Indicator' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information