Full description

Virus:	VBS/Autorun.l2
Date discovered:	23/01/2008
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low
Static file:	Yes
File size:	6.053 Bytes
MD5 checksum:	153e90f0ca2a0de93da62e6789c91f22
IVDF version:	7.00.02.35 - Wednesday, January 23, 2008

General Method of propagation:
   • Autorun feature

Aliases:
   • Mcafee: VBS/Autorun.worm.au
   • Sophos: W32/Autorun-AWJ
   • Panda: VBS/Autorun.EB
   • Eset: VBS/AutoRun.L
   • Bitdefender: Trojan.VBS.Autorun.ACS

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Lowers security settings
   • Registry modification

Files It copies itself to the following location:
   • %drive%\UserConfig.vbs

It deletes the following files:
   • %TEMPDIR%\username.bat
   • %TEMPDIR%\username.txt
   • %SYSDIR%\username.txt
   • %TEMPDIR%\TempCmd.cmd
   • %TEMPDIR%\TempReg.reg

The following files are created:

– %TEMPDIR%\TempReg.reg This is a non malicious text file with the following content:
   • %code that runs malware%

– %SYSDIR%\username.txt
– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %TEMPDIR%\username.txt
– %TEMPDIR%\username.bat Furthermore it gets executed after it was fully created.
– %TEMPDIR%\TempCmd.cmd Furthermore it gets executed after it was fully created.

It tries to executes the following files:

– Filename:
   • cmd /c ""C:\Temp\TempCmd.cmd" "

– Filename:
   • regedit /s C:\Temp\TempReg.reg

– Filename:
   • cmd /c ""C:\Temp\username.bat" "

Registry One of the following values is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "RunUserConfig"="%TEMPDIR%\UserConfig.vbs"

The following registry key is changed:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   New value:
   • "ShowSuperHidden"=dword:0x00000000

说明添加者： Petre Galan 打开 2010年4月1日星期四
说明更新者： Petre Galan 打开 2010年4月1日星期四

反馈 . . . .

我的帐户