Win32.HLLW.Autoruner.60152

To ensure autorun and distribution:

Creates the following services:

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

Malicious functions:

Creates and executes the following:

Executes the following:

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

\Device\LanmanRedirector\192.168.19.2\pipe\browser
\Device\LanmanRedirector\192.168.19.3\pipe\browser
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IJBU4WF7\jxkpme[1].bmp
<SYSTEM32>\x
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\TUSE347B\wpad[1].dat
\Device\LanmanRedirector\192.168.19.7\pipe\browser
\Device\LanmanRedirector\192.168.19.8\pipe\browser
\Device\LanmanRedirector\192.168.19.6\pipe\browser
\Device\LanmanRedirector\192.168.19.4\pipe\browser
\Device\LanmanRedirector\192.168.19.5\pipe\browser
<Current directory>\a.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IJBU4WF7\desktop.ini
<SYSTEM32>\01.tmp
<SYSTEM32>\qqqqqqqq.vmx
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\file1[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\TUSE347B\desktop.ini
<Current directory>\b.exe
\Device\LanmanRedirector\192.168.19.1\pipe\browser
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\file2[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\23CHAXSZ\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0YZLJ20S\desktop.ini

Sets the 'hidden' attribute to the following files:

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0YZLJ20S\desktop.ini
<Drive name for removable media>:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx
<Drive name for removable media>:\autorun.inf
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\23CHAXSZ\desktop.ini
<SYSTEM32>\kvzgmyr.dll
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IJBU4WF7\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\TUSE347B\desktop.ini

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP: