JavaScript support is required for our site to be fully operational in your browser.
Win32.HLLW.Autoruner1.35031
Added to the Dr.Web virus database:
2013-04-08
Virus description added:
2013-04-18
Technical Information
Malicious functions:
Creates and executes the following:
C:\kyxnjeor.exe
C:\eqqc.exe
C:\gwtdxo.exe
C:\-1998166001
C:\fivn.exe
C:\vejdh.exe
C:\cwxt.exe
C:\acqdgllh.exe
C:\-1998166001 (downloaded from the Internet)
C:\eqqc.exe (downloaded from the Internet)
C:\acqdgllh.exe (downloaded from the Internet)
C:\vejdh.exe (downloaded from the Internet)
C:\cwxt.exe (downloaded from the Internet)
C:\fivn.exe (downloaded from the Internet)
C:\gwtdxo.exe (downloaded from the Internet)
C:\kyxnjeor.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
C:\eqqc.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\scqqd[1].php
C:\gwtdxo.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ekyymmqe[1].php
C:\acqdgllh.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\roopttxy[1].php
C:\-1998166001
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\qjxkoptg[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zwjkbb[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xdqrivm[1].php
C:\vejdh.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zjjaof[1].php
C:\cwxt.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\agqqerbspt[1].php
C:\kyxnjeor.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\clzqdervli[1].php
C:\fivn.exe
Deletes itself.
Network activity:
Connects to:
TCP:
HTTP GET requests:
aa####liance.com/progs/jhnrrff/scqqd.php?ad########
aa####liance.com/progs/jhnrrff/ekyymmqe.php
aa####liance.com/progs/jhnrrff/roopttxy.php?ad#################################################
aa####liance.com/progs/jhnrrff/qjxkoptg.php
aa####liance.com/progs/jhnrrff/zwjkbb
aa####liance.com/progs/jhnrrff/xdqrivm.php
aa####liance.com/progs/jhnrrff/zjjaof.php
aa####liance.com/progs/jhnrrff/agqqerbspt.php
aa####liance.com/progs/jhnrrff/clzqdervli.php
UDP:
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK