Win32.HLLW.Autoruner1.35747

Added to the Dr.Web virus database: 2013-04-23

Virus description added: 2013-04-30

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'dlnajjbdfa' = '%WINDIR%\system\llwzjy081129.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Executes the following:

Injects code into

the following user processes:

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mydown[1].asp
%WINDIR%\mydown.asp
%WINDIR%\system\mvjaj32dla.dll
%WINDIR%\system\llwzjy081129.exe
%ALLUSERSPROFILE%\jjjydf16.ini

Deletes the following files:

%WINDIR%\mydown.asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mydown[1].asp

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: