Full description

Virus:	WORM/Autorun.bhko
Date discovered:	17/05/2010
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low to medium
Static file:	Yes
File size:	36.864 Bytes
MD5 checksum:	7b508569587800f36a602faf565a44e2
VDF version:	7.10.07.115

General Method of propagation:
   • Mapped network drives

Aliases:
   • Symantec: W32.SillyFDC
   • Kaspersky: Worm.Win32.AutoRun.bhko
   • TrendMicro: WORM_AUTORUN.MTZ
   • F-Secure: Trojan.Generic.4126632
   • Sophos: Mal/SillyFDC-F
   • Panda: W32/Autorun.JXY
   • VirusBuster: Worm.AutoRun.APJH
   • Eset: Win32/AutoRun.VB.PA
   • Bitdefender: Trojan.Generic.4126632

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
   • %HOME%\%username%1\winlogon.exe

The following file is created:

– %HOME%\%username%1\VERSION.TXT This is a non malicious text file with the following content:
   • 190

It tries to download some files:

– The location is the following:
   • http://0-0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.in**********
It is saved on the local hard drive under: %HOME%\%username%1\wlo.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Dropper.Gen

– The locations are the following:
   • http://0-0-0-1-0-1-1-1-1-1-0-1-0-1-1-1-1-0-0-0-0-0-1-1-1-1-1-1-1-1-1-.0-0-0-0-0-0-0-0-0-0-0-0-0-19-0-0-0-0-0-0-0-0-0-0-0-0-0.in**********
   •
It is saved on the local hard drive under: %HOME%\%username%1\winhelp32.exe Detected as: WORM/VBNA.B.370

Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "NVIDIA Media Center Library"="%HOME%\%username%1\winlogon.exe"

– [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
• "NVIDIA Media Center Library"="%HOME%\%username%1\winlogon.exe"

File details Programming language:
The malware program was written in Visual Basic.

說明撰寫者 Alexandru Dinu 開啟 2010年7月9日星期五
說明更新者 Alexandru Dinu 開啟 2010年7月9日星期五

返回 . . . .

需要修復電腦？

我的帳戶