Win32.HLLW.Autoruner2.53968

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%APPDATA%\WindowsUpdate.exe'

Creates the following files on removable media

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

Injects code into

the following system processes:

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Identities\{D6909BE8-EA09-4677-9635-1238019FCABC}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{D6909BE8-EA09-4677-9635-1238019FCABC}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\Software\Yahoo\Pager]
[<HKCU>\Software\Microsoft\IdentityCRL]
[<HKCU>\Software\Microsoft\Windows Live Mail]

Reads files which store third party applications passwords

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Deletes the following files

Network activity

UDP

Miscellaneous

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\holdermail.txt"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\holderwb.txt"