Characteristics -
W32/HLLP.Philis.ini is the detection for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus.
W32/HLLP.Philis is a file infecting virus that prepends its code to executable files. More information about one of its variants is availavle at the following link:
o http://vil.nai.com/vil/content/v_140647.htm
Variants of The W32/HLLP.Philis virus create this file with the name "_desktop.ini" in every folder that they visit while looking for executable files to infect. This is created as a hidden system file and contains the date on which virus was executed to visit the folder in which the file resides. The date is shown in yyyy/mm/dd format.
Variants of W32/HLLP.Philis virus also spread via network shares. If the virus is able to access a shared resource, it first copies W32/HLLP.Philis.ini to the root of the share to mark the share as visited by the virus and then infects executables present in the share. So, in the case of a shared printer, the viruses' infection routine effectively creates printer job to print the date as contained in W32/HLLP.Philis.ini that the virus tries to copy.
W32/HLLP.Philis.ini is the detection for the "_desktop.ini" files created by variants of W32/HLLP.Philis virus.
W32/HLLP.Philis is a file infecting virus that prepends its code to executable files. More information about one of its variants is availavle at the following link:
o http://vil.nai.com/vil/content/v_140647.htm
Variants of The W32/HLLP.Philis virus create this file with the name "_desktop.ini" in every folder that they visit while looking for executable files to infect. This is created as a hidden system file and contains the date on which virus was executed to visit the folder in which the file resides. The date is shown in yyyy/mm/dd format.
Variants of W32/HLLP.Philis virus also spread via network shares. If the virus is able to access a shared resource, it first copies W32/HLLP.Philis.ini to the root of the share to mark the share as visited by the virus and then infects executables present in the share. So, in the case of a shared printer, the viruses' infection routine effectively creates printer job to print the date as contained in W32/HLLP.Philis.ini that the virus tries to copy.
Could you plz reupload infected Volumes? This thing can only be destroyed if I delete entire files.


