Win32.HLLW.Autoruner1.25138

Added to the Dr.Web virus database: 2012-08-23

Virus description added: 2012-11-05

To ensure autorun and distribution:

Modifies the following registry keys:

Malicious functions:

Creates and executes the following:

%HOMEPATH%\Templates\installstat.exe
%TEMP%\nsw2.tmp\ns3.tmp "<SYSTEM32>\cscript.exe" "%PROGRAM_FILES%\EditPlus\kk14.icw"

Executes the following:

Searches for registry branches where third party applications store passwords:

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\baidu\baidu-dzl.exe
%HOMEPATH%\Templates\installstat.exe
%TEMP%\nsw2.tmp\ns3.tmp
%PROGRAM_FILES%\EditPlus\kk14.icw
%TEMP%\nsw2.tmp\nsExec.dll
%TEMP%\nsw2.tmp\InstallOptions.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\huhawang[1]
%TEMP%\nsw2.tmp\modern-wizard.bmp
%HOMEPATH%\Templates\statistics.dll
%TEMP%\nsw2.tmp\ioSpecial.ini
%HOMEPATH%\Templates\kk14.icw
%HOMEPATH%\Desktop\Internat Exlporer.lnk
%PROGRAM_FILES%\WinRAR\14\14.dat
%PROGRAM_FILES%\WinRAR\14\Desktop.ini
%TEMP%\nsw2.tmp\System.dll
%PROGRAM_FILES%\WinRAR\14\target.lnk
C:\1________________________________________________________________________________________________________________________________________________________________________________________________________________.ani
%PROGRAM_FILES%\EditPlus\1314.bat
%HOMEPATH%\Desktop\МФ ±¦ Нш №є.lnk
%HOMEPATH%\Desktop\НшЦ·Ц®јТ.1nk
%TEMP%\nsw2.tmp\AccessControl.dll

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

HTTP POST requests:

UDP:

Miscellaneous:

Searches for the following windows: