Win32.HLLW.Autoruner.62591

Added to the Dr.Web virus database: 2011-10-07

Virus description added: 2011-10-07

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\Favorites\系统下载.lnk
<Drive name for removable media>:\Favorites\青苹果家园.lnk
<Drive name for removable media>:\Favorites\好123网址之家.lnk
<Drive name for removable media>:\Favorites\Links\青苹果家园.url
<Drive name for removable media>:\Favorites\Links\hao123网址之家.url
<Drive name for removable media>:\Documents\Default.rdp
<Drive name for removable media>:\Favorites\Desktop.ini
<Drive name for removable media>:\Documents\desktop.ini
<Drive name for removable media>:\Favorites\Links\desktop.ini
<Drive name for removable media>:\Favorites\XP系统资源.lnk
<Drive name for removable media>:\Favorites\999w网址大全.lnk
<Drive name for removable media>:\Documents\Tencent Files\All Users\QQ\Registry.db

Malicious functions:

Creates and executes the following:

Executes the following:

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Deletes itself.

Miscellaneous:

Searches for the following windows: