Threat Database Worms Win32.HLLW.Phorpiex.54

Win32.HLLW.Phorpiex.54

By ZulaZuza in Worms

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 115
First Seen: April 5, 2013
Last Seen: March 25, 2023
OS(es) Affected: Windows

Win32.HLLW.Phorpiex.54 is a worm, which proliferates via spam email attachments or copies itself to removable data storage devices and enables attackers to obtain full remote access and control of an affected PC. Win32.HLLW.Phorpiex.54 may also be distributed via via instant messaging programs, such as Skype, Google Talk, Paltalk, Xfire, ICQ, and Windows Live Messenger. PC users may unknowingly download Win32.HLLW.Phorpiex.54, thinking it is a legal program. Win32.HLLW.Phorpiex.54 sends a message to all of the affected computer owner's contacts, and strives to attract or fool him/her into downloading and opening a picture, which may be a copy of Win32.HLLW.Phorpiex.54. The message is localized, and Win32.HLLW.Phorpiex.54 selects which message to send depending on the set language of the compromised PC. Win32.HLLW.Phorpiex.54 may drop malevolent files, which may be found as security infections.

Aliases

12 security vendors flagged this file as malicious.

Anti-Virus Software Detection
AVG Generic_r.BUT
Ikarus Trojan.Win32.Bublik
Comodo Heur.Corrupt.PE
eSafe Suspicious File
F-Prot W32/Damaged_File.B.gen!Eldorado
Fortinet W32/Injector.FJX!tr
Ikarus Trojan.SuspectCRC
McAfee-GW-Edition Artemis!E896CEEF1DCB
DrWeb Win32.HLLW.Phorpiex.54
Kaspersky UDS:DangerousObject.Multi.Generic
Symantec Trojan.Fakeavlock
McAfee BackDoor-FAQI

SpyHunter Detects & Remove Win32.HLLW.Phorpiex.54

File System Details

Win32.HLLW.Phorpiex.54 may create the following file(s):
# File Name MD5 Detections
1. winmgr.exe e896ceef1dcbcfc491a7fa02084fe6db 6
2. EF05.exe b62dd064d09cc254792121a95d822dd8 1
3. %HOMEPATH%\S-10-5765-8772-1584\winmgr.exe
4. [SYSTEM32]\wbem\Performance\WmiApRpl_new.ini

Registry Details

Win32.HLLW.Phorpiex.54 may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List '%HOMEPATH%\S-10-5765-8772-1584\winmgr.exe' = '%HOMEPATH%\S-10-5765-8772-1584\winmgr.exe:*:Enabled:Microsoft Windows Manage
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 'Microsoft Windows Manager' = '%HOMEPATH%\S-10-5765-8772-1584\winmgr.exe'

Trending

Most Viewed

Loading...