Win32.HLLW.Autoruner2.15104

To ensure autorun and distribution:

Changes the following executable system files:

Substitutes the following executable system files:

Infects the following executable files:

Creates the following files on removable media:

Malicious functions:

Executes the following:

'<SYSTEM32>\net1.exe' stop "Norton AntiVirus Server"
'<SYSTEM32>\cacls.exe' <SYSTEM32>\packet.dll /e /p everyone:f
'<SYSTEM32>\cacls.exe' <SYSTEM32>\pthreadVC.dll /e /p everyone:f
'<SYSTEM32>\net1.exe' stop "Symantec AntiVirus Drivers Services"
'<SYSTEM32>\net1.exe' stop "Symantec AntiVirus Definition Watcher"
'<SYSTEM32>\net1.exe' stop "McAfee Framework ·юОс"
'<SYSTEM32>\cacls.exe' <DRIVERS>\acpidisk.sys /e /p everyone:f
'<SYSTEM32>\cacls.exe' <SYSTEM32>\wanpacket.dll /e /p everyone:f
'<SYSTEM32>\cacls.exe' %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\Жф¶Ї /e /p everyone:f
'<SYSTEM32>\cacls.exe' <SYSTEM32>\wpcap.dll /e /p everyone:f
'<SYSTEM32>\cacls.exe' <DRIVERS>\npf.sys /e /p everyone:f
'<SYSTEM32>\cacls.exe' <SYSTEM32>\npptools.dll /e /p everyone:f
'<SYSTEM32>\net.exe' stop "Symantec AntiVirus"
'<SYSTEM32>\net1.exe' stop McShield
'<SYSTEM32>\net.exe' stop "Symantec AntiVirus Drivers Services"
'<SYSTEM32>\net.exe' stop McShield
'<SYSTEM32>\net.exe' stop KWhatchsvc
'<SYSTEM32>\net.exe' stop KPfwSvc
'<SYSTEM32>\net1.exe' stop "Symantec AntiVirus"
'<SYSTEM32>\net.exe' stop "McAfee Framework ·юОс"
'<SYSTEM32>\net.exe' stop "Norton AntiVirus Server"
'<SYSTEM32>\net1.exe' stop KWhatchsvc
'<SYSTEM32>\net.exe' stop "Symantec AntiVirus Definition Watcher"
'<SYSTEM32>\net1.exe' stop KPfwSvc

Terminates or attempts to terminate

the following user processes:

Restores hooked functions in System Service Descriptor Table (SSDT).

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Miscellaneous:

Searches for the following windows: