Content
W32/HLLP.Philis.ini
- Type
- Virus
- SubType
- Configuration settings
- Discovery Date
- 09/25/2006
- Length
- Minimum DAT
- 4859 (09/25/2006)
- Updated DAT
- 5272 (04/11/2008)
- Minimum Engine
- 5.1.00
- Description Added
- 09/25/2006
- Description Modified
- 05/07/2008 10:07 PM (PT)
Tab Navigation
Characteristics
W32/HLLP.Philis.ini is the detection for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus.
W32/HLLP.Philis is a file infecting virus that prepends its code to executable files. More information about one of its variants is availavle at the following link:
Variants of The W32/HLLP.Philis virus create this file with the name "_desktop.ini" in every folder that they visit while looking for executable files to infect. This is created as a hidden system file and contains the date on which virus was executed to visit the folder in which the file resides. The date is shown in yyyy/mm/dd format.
Variants of W32/HLLP.Philis virus also spread via network shares. If the virus is able to access a shared resource, it first copies W32/HLLP.Philis.ini to the root of the share to mark the share as visited by the virus and then infects executables present in the share. So, in the case of a shared printer, the viruses' infection routine effectively creates printer job to print the date as contained in W32/HLLP.Philis.ini that the virus tries to copy.
Symptoms
- Presence of hidden system files named "_desktop.ini" in many folders.
Method of Infection
This detection is for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus. These files do not infect/replicate on their own.
More information about one of the variants of W32/HLLP.Philis virus is available at:
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
W32/HLLP.Philis.ini is the detection for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus. These are created as a hidden system files and contain the date on which virus was executed to visit the folder in which the file resides.
Characteristics
Characteristics -
W32/HLLP.Philis.ini is the detection for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus.
W32/HLLP.Philis is a file infecting virus that prepends its code to executable files. More information about one of its variants is availavle at the following link:
Variants of The W32/HLLP.Philis virus create this file with the name "_desktop.ini" in every folder that they visit while looking for executable files to infect. This is created as a hidden system file and contains the date on which virus was executed to visit the folder in which the file resides. The date is shown in yyyy/mm/dd format.
Variants of W32/HLLP.Philis virus also spread via network shares. If the virus is able to access a shared resource, it first copies W32/HLLP.Philis.ini to the root of the share to mark the share as visited by the virus and then infects executables present in the share. So, in the case of a shared printer, the viruses' infection routine effectively creates printer job to print the date as contained in W32/HLLP.Philis.ini that the virus tries to copy.
Symptoms
Symptoms -
- Presence of hidden system files named "_desktop.ini" in many folders.
Method of Infection
Method of Infection -
This detection is for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus. These files do not infect/replicate on their own.
More information about one of the variants of W32/HLLP.Philis virus is available at:
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
