Win32.HLLW.Autoruner1.34222

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'omc.dll.exe' = 'C:/windows/system32/omc.dll.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Olrox.exe' = 'C:/windows/ShellNew/Olrox.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Issas.exe' = 'C:/windows/System32/Issas.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'command.com.com' = 'C:/Command.com.com'

Creates the following files on removable media:

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Executes the following:

<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v omc.dll.exe /t REG_SZ /d C:/windows/system32/omc.dll.exe
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Olrox.exe /t REG_SZ /d C:/windows/ShellNew/Olrox.exe
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Issas.exe /t REG_SZ /d C:/windows/System32/Issas.exe
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v command.com.com /t REG_SZ /d C:/Command.com.com
<SYSTEM32>\reg.exe add HKCU\software\microsoft\windows\currentversion\policies\system /v disabletaskmgr /t reg_dword /d "1" /f
<SYSTEM32>\reg.exe add HKCU\software\microsoft\windows\currentversion\policies\system /v disableregistrytools /t reg_dword /d "1" /f
<SYSTEM32>\shutdown.exe -r -t 00
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT/CurrentVersion/Winlogon /v logonprompt /t REG_SZ /d W32/Olrox.a /F
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Polices\Explorer /v NoSaveSettings /T REG_DWORD /D 1 /F
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore /v NoClose /t REG_DWORD /D 1 /F
<SYSTEM32>\taskkill.exe /F /IM iexplore.exe
<SYSTEM32>\taskkill.exe /F /IM firefox.exe
<SYSTEM32>\taskkill.exe /F /IM msnmsgr.exe
<SYSTEM32>\taskkill.exe /F /IM notepad.exe
<SYSTEM32>\taskkill.exe /F /IM cmd.exe

Terminates or attempts to terminate

a large number of user processes.

Sets a new unauthorized home page for Windows Internet Explorer.

Attempts to shut down the Windows operating system.

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Miscellaneous:

Searches for the following windows: