TR/Autorun.aad - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Autorun.aad
Date discovered:	13/12/2007
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low to medium
Distribution Potential:	Low to medium
Damage Potential:	Low to medium
Static file:	Yes
File size:	229.489 Bytes
MD5 checksum:	65d52f063bca0Deff652424c9e359675
IVDF version:	7.00.01.88

General Method of propagation:
   • Mapped network drives

Aliases:
   • Mcafee: W32/Autorun.worm.g
   • Kaspersky: Virus.Win32.AutoRun.abt
   • F-Secure: Virus.Win32.AutoRun.abt
   • Grisoft: Worm/Autoit.GE
   • Eset: Win32/Sohanad.NBT

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops files
   • Registry modification

Files It copies itself to the following locations:
   • %WINDIR%\xmss.exe
   • %WINDIR%\Funny UST Scandal.exe
   • %drive%:\xmss.exe
   • %drive%:\Funny UST Scandal.exe

The following files are created:

– %WINDIR%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %drive%:\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

Registry The following registry keys are changed:

– [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Old value:
   • Shell = explorer.exe
   New value:
   • Shell = explorer.exe, xmss.exe

– [HKCR\.vbs]
   Old value:
   • (Default) = vbsfile
   New value:
   • (Default) = exefile

– [HKCR\.reg]
   Old value:
   • (Default) = regfile
   New value:
   • (Default) = exefile

Various Explorer settings:
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\Hidden\SHOWALL]
   Old value:
   • CheckedValue = %user defined settings%
   New value:
   • CheckedValue = 0

– [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   Old value:
   • NoDriveTypeAutoRun = %user defined settings%
   New value:
   • NoDriveTypeAutoRun = ff

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Andrei Gherman on Tue, 08 Jan 2008 08:49 (GMT+1)
Description updated by Andrei Gherman on Tue, 08 Jan 2008 08:54 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back