Win32.HLLW.Rubbish.275

Added to the Dr.Web virus database: 2013-03-23

Virus description added: 2013-04-04

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Executes the following:

<SYSTEM32>\svchost.exe -k netsvcs
<SYSTEM32>\dumprep.exe 1144 -dm 7 7 %TEMP%\WER77f3.dir00\svchost.exe.hdmp 16325836412029684
<SYSTEM32>\dumprep.exe 1144 -dm 7 7 %TEMP%\WER77f3.dir00\svchost.exe.mdmp 16325836412029776

Terminates or attempts to terminate

the following user processes:

Modifies file system :

Creates the following files:

%TEMP%\WER77f3.dir00\svchost.exe.hdmp
%TEMP%\WER77f3.dir00\svchost.exe.mdmp
%TEMP%\WER77f3.dir00\manifest.txt
%TEMP%\WER77f3.dir00\appcompat.txt
<SYSTEM32>\taimpo.txt
<SYSTEM32>\utility.hiv
<SYSTEM32>\Com\comrepl32.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\elf_listo[1].txt
<DRIVERS>\pcidisk.sys

Deletes the following files:

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

Miscellaneous:

Searches for the following windows: