Sophos

W32/AutoRun-GO

Aliases
  • Win32/Autoit.BA
  • Worm.Win32.AutoIt.i
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from September 2008 (4.33)
Protection available since 23 July 2008 07:00:01 (GMT)
Detected by All Sophos products

Action

More Information

W32/AutoRun-GO is a worm for the Windows platform.

When run W32/AutoRun-GO copies itself to <System>\msmsgs.exe and <Windows>\autorun.inf (detected as W32/SillyFDC-AP).

The following registry entries are set :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Msmsgs
<System>\Msmsgs.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS1
<System>\system.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS2
<System>\bad1.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS3
<System>\bad2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYS4
<System>\bad3.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
5b

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFind
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableRegistryTools
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr
1

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer