W32/AutoRun-VZ is a worm for the Windows platform.
When first run W32/AutoRun-VZ copies itself to <System>\csrcs.exe.
The following registry entry is created to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
csrcs
<System>\csrcs.exe
The following registry entry is changed to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe csrcs.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\DRM\amty