Win32.HLLW.Autoruner2.42202

Added to the Dr.Web virus database: 2018-07-21

Virus description added: 2018-07-21

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ZydFEvaD5IuXmRYfcuLs5uE' = '"%TEMP%\IExplorer.exe" ..'

Creates or modifies the following files:

Creates the following files on removable media:

Modifies file system:

Creates the following files:

%ALLUSERSPROFILE%\Application Data\KMSAuto\driver_booster_setup\1.0.0.0\temp\a1.exe
%ALLUSERSPROFILE%\Application Data\KMSAuto\driver_booster_setup\1.0.0.0\temp\a2.exe
%TEMP%\IExplorer.exe

Sets the 'hidden' attribute to the following files:

Network activity:

Connects to:

UDP:

Miscellaneous:

Creates and executes the following:

'%ALLUSERSPROFILE%\Application Data\KMSAuto\driver_booster_setup\1.0.0.0\temp\a1.exe'
'%TEMP%\IExplorer.exe'