W32/AutoRun-BEL

Category: Viruses and SpywareProtection available since:27 Jun 2010 07:29:30 (GMT)
Type: Win32 wormLast Updated:27 Jun 2010 07:29:30 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/AutoRun-BEL is a worm for the Windows platform.

When run W32/AutoRun-BEL creates the files:
<System>\jcview.exe - detected as W32/Autorun-AT
<System>\systtray.exe - detected as W32/Autorun-AT
<Temp>\MMBPlayer\Press.exe - detected as W32/Autorun-AT
<Root>\autorun.inf - detected as W32/AutoRun-BEL

The following registry entries are set:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RunJava
<System>\jcview.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RunJava2
<System>\systtray.exe

HKCU\Control Panel\Desktop
SCRNSAVE.EXE
<System>\First.scr