W32/Autorun-DL

Please follow the instructions for removing worms.

W32/Autorun-DL is a worm for the Windows platform that spreads to removable storage devices.

W32/Autorun-DL includes functionality to download, install and run new software.

When first run W32/Autorun-DL copies itself to <System>\msmsgs.exe and creates the following files:

<Windows>\autorun.inf
<System>\bad1.exe
<System>\bad2.exe
<System>\bad3.exe

The file autorun.if is detected as W32/SillyFDC-AP.

The following registry entries are created to run W32/Autorun-DL on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS2
<System>\bad1.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS3
<System>\bad2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS4
<System>\bad3.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Msmsgs
<System>\Msmsgs.exe

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableRegistryTools
1

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
5b