high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 15 January 2009 00:57:53 (GMT) |
| Last updated | 24 February 2009 03:25:29 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
VBS/AutoRun-UC is a worm for the Windows platform.
VBS/AutoRun-UC copies itself to removable drives, creating an autorun.inf file to execute itself when the drive is inserted into a computer running the Windows operating system.
VBS/AutoRun-UC creates the following registry entry to run itself on system startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Explorer
wscript.exe //e:VBScript "<currentdirectory>\database.mdb"
VBS/AutoRun-UC may also set the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
WinUpdate
Wscript.exe //e:VBScript "<Windows>\:Microsoft Office Update for Windows XP.sys"
VBS/AutoRun-UC copies itself to every folder on the system as Thumb.db and creates a link to itself in each folder.
VBS/AutoRun-UC creates component files in the <Temp> folder with temporary filenames. Some of these are also detected as VBS/AutoRun-UC, whilst the other files are innocuous TXT files and may be simply deleted.
|
