W32/Autorun-BAW is a worm for the Windows platform.
W32/Autorun-BAW includes functionality to:
- run automatically
- access the internet and communicate with a remote server via HTTP
W32/Autorun-BAW communicates via HTTP with the following locations:
yahooui0 . com
When W32/Autorun-BAW is installed the following files are created:
<Temp>\cvasds0.dll
<Temp>\herss.exe
<Root>\autorun.inf
<Root>\ji83j.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
SHOWALL
CheckedValue
Registry entries are created under:
HKCR\CLSID
HKLM\SOFTWARE\Microsoft\DownloadManager