Win32.HLLW.Autoruner1.29024

Added to the Dr.Web virus database: 2012-10-31

Virus description added: 2012-10-31

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dhtdll32' = '<SYSTEM32>\<Virus name>.exe'

Creates the following files on removable media:

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Executes the following:

<SYSTEM32>\attrib.exe +a +s +h \Autorun.inf
<SYSTEM32>\attrib.exe +a +s +h \<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h z: [\\.host\Shared Folders\vm_shara]\Autorun.inf
<SYSTEM32>\attrib.exe +a +s +h z: [\\.host\Shared Folders\vm_shara]\<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h /s /d e:\RECYCLER
<SYSTEM32>\attrib.exe +a +s +h /s /d z: [\\.host\Shared Folders\vm_shara]\RECYCLER
<SYSTEM32>\attrib.exe +a +s +h /s /d a:\RECYCLER
<SYSTEM32>\attrib.exe +a +s +h /s /d <Drive name for removable media>:\RECYCLER
<SYSTEM32>\attrib.exe +a +s +h e:\<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h a:\<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h c:\Autorun.inf
%WINDIR%\regedit.exe /s C:\X.reg
<SYSTEM32>\attrib.exe +a +s +h a:\Autorun.inf
<SYSTEM32>\attrib.exe +a +s +h <Drive name for removable media>:\<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h e:\Autorun.inf
<SYSTEM32>\attrib.exe +a +s +h c:\<Virus name>.exe
<SYSTEM32>\attrib.exe +a +s +h <Drive name for removable media>:\Autorun.inf

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Miscellaneous:

Searches for the following windows: