Win32.HLLM.Graz.328

Win32.HLLM.Graz.328

Added to the Dr.Web virus database: 2013-04-23

Virus description added: 2013-05-01

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe] 'Debugger' = 'srvm.exe'

Malicious functions:

Creates and executes the following:

Injects code into

the following system processes:

the following user processes:

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Modifies file system :

Creates the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP: