W32/Autorun.worm.h

W32/Autorun.worm.h will also perform the following tasks:

It will modify Windows Registry and add the following entries:

  • HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Current Version\Explorer\{35106240-D2F0-DB35-716E-127EB80A0299}
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Current Version\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}

W32/Autorun.worm.hwill drop the following malicious files and folder:

  • %SystemDrive%\Diskrun.exe
  • %WINDIR%\system32\lowsec\local.ds
  • %WINDIR%\system32\lowsec\user.ds
  • %WINDIR%\system32\lowsec\user.ds.lll
  • %WINDIR%\System32\sdra64.exe
  • %SystemDrive%\Autorun.inf
  • %WINDIR%\system32\lowsec

Leave a Comment