Win32.HLLW.Autoruner1.25043

Added to the Dr.Web virus database: 2012-08-18

Virus description added: 2012-09-08

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'csrss' = 'C:\Users\Public\smxss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = 'C:\Users\Public\smxss.exe'

Creates the following files on removable media:

Malicious functions:

Creates and executes the following:

Executes the following:

<SYSTEM32>\cmd.exe /c C:\Users\Public\aognradikgow.bat
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v csrss /d C:\Users\Public\smxss.exe /f
<SYSTEM32>\taskkill.exe /f /im <Virus name>.exe
<SYSTEM32>\cmd.exe /c C:\Users\Public\load.bat
<SYSTEM32>\tskill.exe /A <Virus name>
<SYSTEM32>\tskill.exe /A smss
<SYSTEM32>\cmd.exe /c C:\mkxxosrw.bat
<SYSTEM32>\taskkill.exe /f /im smss.exe
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v csrss /d C:\Users\Public\smxss.exe /f
<SYSTEM32>\cmd.exe /c C:\Users\Public\cpx.bat

Modifies file system :

Creates the following files:

C:\autorun.inf
C:\SandiskU3.exe
C:\Users\Public\smxss.exe
C:\Users\Public\instlx978x.txt
C:\Users\Public\load.bat
C:\Users\Public\sys\svchost.exe
C:\Users\Public\aognradikgow.bat
C:\Users\Public\okcgoethvbyt.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xxx[1].EXE
C:\mkxxosrw.bat
C:\Users\Public\extmgr.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\vert[1].exe
C:\Users\Public\cpx.bat
C:\Users\Public\ar.i

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: