W32/Autorun-T

Category: Viruses and SpywareProtection available since:03 Dec 2007 01:24:22 (GMT)
Type: Win32 wormLast Updated:03 Dec 2007 01:24:22 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Autorun-T is a worm for the Windows platform.

W32/Autorun-T contains functionality to spread via removable storage devices.

When first run W32/Autorun-T copies itself to <Program Files>\Network Associates\VirusScan\McaUpdate.exe and creates the file <System>\drivers\inc\sysdeb.ini.

When a removable storage device is plugged into the computer, W32/Autorun-T will create the files <Root>\autorun.inf and <Root>\RECYCLER\RECYCLER\autorun.exe on the device.

The following registry entry is created to run McaUpdate.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
McaFee virus detect program.
<Program Files>\Network Associates\VirusScan\McaUpdate.exe