W32/Autoit-BP

Please follow the instructions for removing worms.

W32/Autoit-BP is a worm for the Windows platform.

W32/Autoit-BP spreads to other network computers.

When first run W32/Autoit-BP copies itself to:

<User>\Local Settings\Application Data\Microsoft\CD Burning\New Folder(3).exe
<User>\Local Settings\Application Data\Microsoft\CD Burning\khatra.exe
<User>\Local Settings\Application Data\Microsoft\CD Burning\repclient1.exe
<User>\My Documents\My Received Files.exe
<User>\My Documents\My Received Files\My Received Files.exe
<User>\My Documents\yahoomentor.exe
<User>\My Documents\yahoomentor\received.exe
<User>\My Documents\yahoomentor\received\received.exe
<User>\My Documents\yahoomentor\shared.exe
<User>\My Documents\yahoomentor\shared\shared.exe
<User>\My Documents\yahoomentor\yahoomentor.exe
<Root>\khatra.exe
<Windows>\KHATARNAKH.exe
<Windows>\Xplorer.exe
<System>\gHost.exe
<System>\khatra.exe

and creates the following files:

<Startup>\(Empty).LNK
<User>\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF
<Windows>\Tasks\At1.job
<Windows>\inf\Autoplay.inF

The following registry entries are created to run Xplorer.exe, gHost.exe and khatra.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
G_Host
<System>\gHost.exe" /Reproduce

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Xplorer
<Windows>\Xplorer.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
1
<System>\KHATRA.exe

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\KHATRA.exe

W32/Autoit-BP changes settings for Microsoft Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\

The following registry entry is set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoControlPanel
1

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Taskman
<System>\KHATRA.exe

HKLM\SOFTWARE\KHATRA\Startup_List
Xplorer
<Windows>\Xplorer.exe" /Windows

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
CheckedValue
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
ff

Registry entries are created under:

HKCU\Software\Nico Mak Computing\WinZip\caution
HKLM\SOFTWARE\KHATRA\Startup_List