Full description

Virus:	Worm/Autorun.qmd
Date discovered:	11/10/2008
Type:	Worm
In the wild:	Yes
Reported Infections:	Low to medium
Distribution Potential:	Low to medium
Damage Potential:	Medium
Static file:	Yes
File size:	119.808 Bytes
MD5 checksum:	fba8171bbc33de1bc4c3e24e80ac69ce
IVDF version:	7.00.07.28 - Saturday, October 11, 2008

General Method of propagation:
• Autorun feature

Aliases:
   • Mcafee: W32/Autorun.worm.gen virus
   • Panda: W32/Autorun.AOH
   • Eset: Win32/AutoRun.ADV
   • Bitdefender: Backdoor.Agent.ZWZ

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification
   • Third party control

Files It copies itself to the following location:
• %drive%\RESTORE\%SID%\rise.exe

The following files are created:

– %drive%\RESTORE\%SID%\Desktop.ini
– %drive%\autorun.inf This is a non malicious text file with the following content:
• %code that runs malware%

Registry The following registry key is added:

– [HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
{28ABC5C0-4FCB-11CF-AAX5-21CX1C642131}]
• "StubPath"="c:\RESTORE\%SID%\rise.exe"

IRC To deliver system information and to provide remote control it connects to the following IRC Server:

Server: lol.st**********.com
Port: 7005
Server password: Virus
Nickname: VirUs-%random character string%

Injection – It injects itself as a remote thread into a process.

Process name:
• explorer.exe

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

説明の挿入者 Petre Galan の 2009年12月4日金曜日
説明の更新者 Petre Galan の 2009年12月4日金曜日

戻る . . . .

マイアカウント