Win32.HLLW.Autoruner3.6997

Added to the Dr.Web virus database: 2023-02-03

Virus description added: 2023-02-05

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, <DRIVERS>\svchost.exe'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UIHost' = 'logonui.exe, <SYSTEM32>\dllcache\recycled.exe'

Creates the following files on removable media

<Drive name for removable media>:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\recycler.scr
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\desktop.ini

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

C:\autorun.inf
C:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\recycler.scr
C:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\desktop.ini
D:\autorun.inf
D:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\recycler.scr
D:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\desktop.ini
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\recycler.scr
<Drive name for removable media>:\recycler\s-1-5-21-8749679017-0950430147-468708784-3200\desktop.ini