high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | August 2007 (4.20) |
| Protection available since | 17 June 2007 06:50:08 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/RecyInf-A is a worm for the Windows platform.
When run W32/RecyInf-A creates the files:
<Root>\autorun.inf - detected as W32/RecyInf-A
<System>\DocProp1.dll - detected as W32/RecyInf-A
<System>\msv1_1.dll - detected as W32/RecyInf-A
<System>\servers.ini - can be safely removed
W32/RecyInf-A spreads via removable shared drives including USB keys. The worm actively copies itself to <Root>\Recycler\<random characters>.exe on the removable media and creates the file <Root>\autorun.inf. The file autorun.inf is designed to run the worm when the removable media is connected to an uninfected computer.
W32/RecyInf-A includes functionality to:
- download code from the internet
- inject code into system processes
The following registry entries are set to run W32/RecyInf-A on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msv1_1\
|
