Win32.HLLW.Autoruner1.58148

Added to the Dr.Web virus database: 2013-10-10

Virus description added: 2013-10-11

To ensure autorun and distribution:

Infects the following executable system files:

Substitutes the following executable system files:

Creates the following files on removable media:

Malicious functions:

Creates and executes the following:

Executes the following:

'<SYSTEM32>\cacls.exe' <DRIVERS>\npf.sys /e /p everyone:f
'<SYSTEM32>\cacls.exe' <SYSTEM32>\npptools.dll /e /p everyone:f
'<SYSTEM32>\net1.exe' stop "Norton AntiVirus Server"
'<SYSTEM32>\cacls.exe' <SYSTEM32>\wpcap.dll /e /p everyone:f
'<SYSTEM32>\cacls.exe' %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\Жф¶Ї /e /p everyone:f
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.ba##uoo.com/tj.htm
'<SYSTEM32>\cacls.exe' <SYSTEM32>\wanpacket.dll /e /p everyone:f
'<SYSTEM32>\cacls.exe' <DRIVERS>\acpidisk.sys /e /p everyone:f
'<SYSTEM32>\net1.exe' stop KPfwSvc
'<SYSTEM32>\net.exe' stop KWhatchsvc
'<SYSTEM32>\net1.exe' stop McShield
'<SYSTEM32>\cacls.exe' <SYSTEM32>\packet.dll /e /p everyone:f
'<SYSTEM32>\net.exe' stop McShield
'<SYSTEM32>\net.exe' stop "Norton AntiVirus Server"
'<SYSTEM32>\cacls.exe' <SYSTEM32>\pthreadVC.dll /e /p everyone:f
'<SYSTEM32>\net.exe' stop KPfwSvc
'<SYSTEM32>\net1.exe' stop KWhatchsvc

Terminates or attempts to terminate

the following user processes:

Restores hooked functions in System Service Descriptor Table (SSDT).

Modifies file system :

Creates the following files:

C:\explorer.pif
C:\AUTORUN.INF
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tj[1].htm
<SYSTEM32>\wuauc1t.exe
<SYSTEM32>\syurl.dll
<SYSTEM32>\winpp1.pif
%PROGRAM_FILES%\Internet Explorer\xpsp2res.dll

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: