Virus:WORM/Agent.347086
Date discovered:29/01/2009
Type:Worm
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low
Static file:Yes
File size:347.086 Bytes
MD5 checksum:f628972a796647542ed1b2dcc1cceaa8
IVDF version:7.01.01.175 - Saturday, January 24, 2009

 General Aliases:
   •  Symantec: W32.SillyDC
   •  Sophos: W32/AutoIt-CY
   •  Panda: W32/Autoit.CK.worm
   •  Grisoft: Worm/Autoit.MBF
   •  Eset: Win32/Autoit.FP


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops a file

 Files It deletes the initially executed copy of itself.



The following file is created:

– %TEMPDIR%\s.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.



It tries to executes the following file:

– Filename:
   • %TEMPDIR%\s.bat
This batch file is used to delete a file.

 Miscellaneous Anti debugging
If it was successful it displays the following and terminates immediately:


Description inserted by Petre Galan on Friday, July 3, 2009
Description updated by Petre Galan on Wednesday, August 19, 2009

Back . . . .