Worm/Autorun.xtl - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Autorun.xtl
Date discovered:	28/08/2008
Type:	Worm
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low
Static file:	Yes
File size:	168.024 Bytes
MD5 checksum:	9cec070A253af16137de68bee0a6e2d3
VDF version:	7.00.06.82 - Thu, 28 Aug 2008 08:24 (GMT+1) - Thu, 28 Aug 2008 08:24 (GMT+1)
IVDF version:	7.00.06.82 - Thu, 28 Aug 2008 08:24 (GMT+1) - Thu, 28 Aug 2008 08:24 (GMT+1)

General Method of propagation:
   • Mapped network drives

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops files
   • Registry modification

Files It copies itself to the following locations:
   • %SYSDIR%\drivers\hate.sys
   • %SYSDIR%\System
   • C:\FOUND.000\USB_Files.chk
   • %drive%\FOUND.000\USB_Files.chk

The following files are created:

– C:\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %WINDIR%\inf\winsis_x.inf This is a non malicious text file with the following content:
   • %code that runs malware%

Registry The following registry keys are changed:

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   Old value:
   • "ShowSuperHidden"=%user defined settings%
   New value:
   • "ShowSuperHidden"=dword:00000000

– [HKCR\exefile\shell\open\command]
   Old value:
   • @="\"%1\" %*"
   New value:
   • @="%SYSDIR%\drivers\hate.sys %1 %*"

File details Programming language:
The malware program was written in MS Visual C++.

See a brief description here.

Description inserted by Alexandru Dinu on Thu, 11 Sep 2008 11:44 (GMT+1)
Description updated by Andrei Ivanes on Wed, 01 Oct 2008 13:50 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back