Win32.HLLW.Autoruner2.9112

Added to the Dr.Web virus database: 2014-02-25

Virus description added: 2014-02-26

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'exp1orer' = 'C:\exp1orer.exe'
[<HKLM>\SOFTWARE\Classes\txtfile\shell\open\command] '' = '%WINDIR%\noteped.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'exp1orer' = '%WINDIR%\exp1orer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'exp1orer' = '%PROGRAM_FILES%\exp1orer.exe'

Creates the following files on removable media:

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Creates and executes the following:

Forces autoplay for removable media.

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%WINDIR%\noteped.exe
%PROGRAM_FILES%\exp1orer.exe
%PROGRAM_FILES%\a.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Sx_server[1].exe
<SYSTEM32>\exp1orer.exe
C:\autorun.inf
C:\exp1orer.exe
%WINDIR%\exp1orer.exe
C:\system.vbs

Sets the 'hidden' attribute to the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP: