Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'service' = '%WINDIR%\dllhost.exe'
Creates or modifies the following files
- %ALLUSERSPROFILE%\start menu\programs\startup\empty.pif
Creates the following files on removable media
- <Drive name for removable media>:\avseq.dat.exe
- <Drive name for removable media>:\autorun.inf
Modifies file system
Creates the following files
- %WINDIR%\dllhost.exe
- %WINDIR%\pl0lonx.jpg
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\autorun.inf
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'dllhost'
