One or more files with the name OLHRWEF.EXE creates, deletes, copies or moves the following files and folders:
- Deletes c:\windows\system32\olhrwef.exe
- Deletes c:\windows\system32\nmdfgds0.dll
- Creates c:\windows\system32\nmdfgds0.dll
- Creates c:\windows\system32\c.exe
- Deletes c:\windows\system32\c.exe
- Deletes c:\oobbyju.ex
- Copies filec:\windows\system32\olhrwef.exe to c:\oobbyju.ex
- Deletes c:\autorun.in
- Creates c:\autorun.in
- Deletes d:\oobbyju.ex
- Copies filec:\windows\system32\olhrwef.exe to d:\oobbyju.ex
- Deletes d:\autorun.in
- Creates d:\autorun.in
- Deletes c:\docume~1\user\locals~1\temp\am1.rar
- Creates c:\docume~1\user\locals~1\temp\am1.rar
- Creates c:\docume~1\user\locals~1\temp\am.exe
- Deletes c:\docume~1\user\locals~1\temp\am.exe
- Deletes c:\windows\temp\scsA1.tmp
- Deletes c:\windows\temp\scsA6.tmp
- Copies filec:\docume~1\user\locals~1\temp\am.exe to c:\windows\system32\olhrwef.exe
- Deletes c:\windows\system32\nmdfgds1.dll
- Creates c:\windows\system32\nmdfgds1.dll
