Win32.HLLW.Autoruner.53576

Aggiunto al database dei virus Dr.Web: 2011-07-07

La descrizione è stata aggiunta: 2011-07-07

To ensure autorun and distribution:

Creates the following files on removable media:

Malicious functions:

Executes the following:

<SYSTEM32>\attrib.exe +r +s e:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s <Drive name for removable media>:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s +h j:\autorun.inf
<SYSTEM32>\attrib.exe +r +s c:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s j:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s %ALLUSERSPROFILE%\Start Menu\Programs\Startup\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s h:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s i:\sysinfo.exe
<SYSTEM32>\attrib.exe +r +s +h i:\autorun.inf
<SYSTEM32>\attrib.exe +r +s +h c:\autorun.inf
<SYSTEM32>\attrib.exe +r +s +h <Drive name for removable media>:\autorun.inf
<SYSTEM32>\taskkill.exe /f /im SSVICHOSST.exe
<SYSTEM32>\taskkill.exe /f /im tazebama.dl_
<SYSTEM32>\attrib.exe +r +s +h g:\autorun.inf
<SYSTEM32>\attrib.exe +r +s +h h:\autorun.inf
<SYSTEM32>\attrib.exe +r +s +h e:\autorun.inf
<SYSTEM32>\attrib.exe +r +s +h f:\autorun.inf

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Miscellaneous:

Searches for the following windows: