Win32.HLLW.Autoruner1.57213

Added to the Dr.Web virus database: 2013-09-27

Virus description added: 2013-09-27

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\vir\winlogon.exe
<Drive name for removable media>:\autorun.infautorun.infautorun.infautorun.infautorun.infautorun.inf
<Drive name for removable media>:\autorun.infautorun.infautorun.infautorun.inf
<Drive name for removable media>:\vir\desktop.ini

Malicious functions:

Executes the following:

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\vir\winlogon.exe
<Drive name for removable media>:\vir\desktop.ini
<Full path to virus>
<Drive name for removable media>:\autorun.infautorun.infautorun.infautorun.infautorun.infautorun.inf
C:\vir\desktop.ini
C:\autorun.infautorun.inf
<Drive name for removable media>:\autorun.infautorun.infautorun.infautorun.inf
C:\vir\winlogon.exe

Moves the following files:

Network activity:

Connects to:

Miscellaneous:

Searches for the following windows: