W32/Autorun-BA is a worm for the Windows platform.
W32/Autorun-BA spreads by copying itself to the available mapped drives and shared folders with the following filenames:
_Fichiers.exe
_Saves.exe
\MisVh55.exe
The following registry entry is set:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
\MisVh55.exe
The worm modifies a number of registry settings including the following:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
DisableSR
0
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore DisableConfig
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden
2