Win32.HLLW.Autoruner.59664

Added to the Dr.Web virus database: 2011-09-22

Virus description added: 2011-09-22

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'atiaudio' = '%PROGRAM_FILES%\Realtek\Audio\HDAudio\RtkUpd.exe'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\$recycle.{645FF040-5081-101B-9F08-00AA002F954E}\recycle.exe

Malicious functions:

Creates and executes the following:

Executes the following:

Injects code into

the following system processes:

Searches for windows to

detect programs and games:

Modifies file system :

Creates the following files:

C:\$recycle.{645FF040-5081-101B-9F08-00AA002F954E}\recycle.exe
C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\px44554344.blog[1]
%PROGRAM_FILES%\Realtek\Audio\HDAudio\RtkUpd.exe
%TEMP%\delme.bat
%PROGRAM_FILES%\Realtek\Audio\HDAudio\RtkHDMI.dll

Sets the 'hidden' attribute to the following files:

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: