Analysis by: Anthony Joe Melgarejo
ALIASES:

Virus:Win32/Hantaner (Microsoft), W32.HLLP.Handy (Symantec), W32/HLLP.Hantaner.dam (McAfee)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This file infector infects certain file types by inserting code in the said files.

  TECHNICAL DETAILS

File Size: 24,064 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 10 Sep 2015

Other System Modifications

This file infector deletes the following files:

  • %Windows%\Hanta
  • %Windows%\010101.dat

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

File Infection

This file infector infects files with the following file extensions by inserting code in the said files:

  • .EXE

NOTES:

This is Trend Micro detection for files infected by HANTANER virus.

It searches for certain directories to infects files.

The files it deletes are non-critical Windows files and may not exist in most systems.

  SOLUTION

Minimum Scan Engine: 9.800
VSAPI OPR PATTERN File: 5.883.00
VSAPI OPR PATTERN Date: 08 Apr 2009

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to delete files detected as PE_HANTANER.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.