Win32.HLLW.Autoruner.10659

Added to the Dr.Web virus database: 2014-10-03

Virus description added: 2014-10-04

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] 'Debugger' = '%CommonProgramFiles%\svchost.exe'

Malicious functions:

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6YQRA29M\get[1].php
%CommonProgramFiles%\svchost.exe

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP: