Win32.HLLW.Autoruner1.35818

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Command Processor] 'Autorun' = '<SYSTEM32>\Command.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe %WINDIR%\MSWinLoader.exe'

Creates the following files on removable media:

<Drive name for removable media>:\Jed Madela - Will of the wind.mp3.exe
<Drive name for removable media>:\Sarah Geronimo - Very Special Love.mp3.exe
<Drive name for removable media>:\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
<Drive name for removable media>:\autorun.ini
<Drive name for removable media>:\wmplayer.exe
<Drive name for removable media>:\autorun.inf

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Executes the following:

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NofolderOptions' = '00000001'

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window Title' = 'Microsoft Internet Explorer :-)'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\Documents\Jed Madela - Will of the wind.mp3.exe
%ALLUSERSPROFILE%\Documents\Sarah Geronimo - Very Special Love.mp3.exe
%ALLUSERSPROFILE%\Documents\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%ALLUSERSPROFILE%\Desktop\MP3 Files\Jed Madela - Will of the wind.mp3.exe
%ALLUSERSPROFILE%\Desktop\MP3 Files\Sarah Geronimo - Very Special Love.mp3.exe
%ALLUSERSPROFILE%\Desktop\MP3 Files\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%HOMEPATH%\My Documents\Sarah Geronimo - Very Special Love.mp3.exe
%HOMEPATH%\My Documents\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Media Player.exe
%ALLUSERSPROFILE%\Start Menu\Windows Media Player.exe
%HOMEPATH%\My Documents\Jed Madela - Will of the wind.mp3.exe
%ALLUSERSPROFILE%\Desktop\Windows Media Player.exe
%WINDIR%\MSWinLoader.exe
<Current directory>\autorun.inf
<Current directory>\Command.bat
<Current directory>\autorun.ini
C:\autorun.ini
%WINDIR%\wmplayer.exe
C:\Jed Madela - Will of the wind.mp3.exe
C:\Sarah Geronimo - Very Special Love.mp3.exe
C:\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
<SYSTEM32>\Command.bat
C:\wmplayer.exe
C:\autorun.inf

Sets the 'hidden' attribute to the following files:

Deletes the following files:

%ALLUSERSPROFILE%\Desktop\MP3 Files\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%ALLUSERSPROFILE%\Documents\Jed Madela - Will of the wind.mp3.exe
%ALLUSERSPROFILE%\Documents\Sarah Geronimo - Very Special Love.mp3.exe
%ALLUSERSPROFILE%\Desktop\Windows Media Player.exe
%ALLUSERSPROFILE%\Desktop\MP3 Files\Jed Madela - Will of the wind.mp3.exe
%ALLUSERSPROFILE%\Desktop\MP3 Files\Sarah Geronimo - Very Special Love.mp3.exe
%HOMEPATH%\My Documents\Jed Madela - Will of the wind.mp3.exe
%HOMEPATH%\My Documents\Sarah Geronimo - Very Special Love.mp3.exe
%HOMEPATH%\My Documents\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%ALLUSERSPROFILE%\Documents\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Media Player.exe
%ALLUSERSPROFILE%\Start Menu\Windows Media Player.exe
<Drive name for removable media>:\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
%WINDIR%\wmplayer.exe
%WINDIR%\MSWinLoader.exe
<SYSTEM32>\Command.bat
C:\Jed Madela - Will of the wind.mp3.exe
C:\Sarah Geronimo - Very Special Love.mp3.exe
C:\Glenn Medeiros _ Nothing's Gonna Change My Love For You.mp3.exe
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\Jed Madela - Will of the wind.mp3.exe
<Drive name for removable media>:\Sarah Geronimo - Very Special Love.mp3.exe
C:\wmplayer.exe
<Drive name for removable media>:\wmplayer.exe
C:\autorun.inf

Miscellaneous:

Searches for the following windows: