Threat Information for "Win32.HLLW.Shadow.based"

StopSign will automatically remove this infection with a paid membership.

• Name: Win32.HLLW.Shadow.based
• Aliases:
• Date Discovered: 2009-03-30
• Protection Added: 2009-03-31

-- Ease of Removal

1: Hides running processes
2: Hides files
3: Hides registry entries
4: Uses rootkit functionality
5: Uses redundant/watcher processes
6: Injects DLLs into running processes
7: Runs as a service
8: Consistent file contents
9: File names uniquely generated
10: Creates new unique registry entries

-- Privacy Risks/Security Changes

1: Disables security software
2: Disables administrator tools
3: Opens backdoors

-- Damage/Intrusion/Annoyance

1: Significantly slows down the computer
2: Creates new files
3: Autoruns at startup without an option to be disabled
4: Downloads other threats

-- Propagation/Saturation

1: Infects with other exploitation method
2: Spreads to other computers on the same network
3: Infects through a blind IP address attack
4: Installed by other infections

• Added Directory/File:
  FilePath: %SYSTEMDIR%\drivers\*.* MD5: 5E279EF7FCB58F841199E0FF55CDEA8B
• Added Directory/File:
  FilePath: %WINDIR%\*.* MD5: 5E279EF7FCB58F841199E0FF55CDEA8B
• Added Directory/File:
  FilePath: ?:\autorun.inf
• Added Directory/File:
  FilePath: %SYSTEMDIR%\*.* MD5: 5E279EF7FCB58F841199E0FF55CDEA8B