Win32.HLLW.Autoruner1.1858

Added to the Dr.Web virus database: 2011-11-09

Virus description added: 2011-11-09

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,NetwkMonitor.exe'

Creates the following files on removable media:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\NetwkMonitor.exe' = '<SYSTEM32>\NetwkMonitor.exe:*:Enabled:NetwkMonitor'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to virus>' = '<Full path to virus>:*:Enabled:NetwkMonitor'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\NetwkMonitor.exe' = 'C:\NetwkMonitor.exe:*:Enabled:NetwkMonitor'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Drive name for removable media>:\NetwkMonitor.exe' = '<Drive name for removable media>:\NetwkMonitor.exe:*:Enabled:NetwkMonitor'

Modifies file system :

Creates the following files:

Network activity:

Connects to:

Miscellaneous:

Searches for the following windows: