Home / malware

PDF

Trojan:BAT/Runner.B

First posted on 01 November 2012.
Source: Microsoft

Aliases :

Trojan:BAT/Runner.B is also known as VBS/Worm (AVG), BAT/Runner.B (Avira), Worm.VBS.AO (BitDefender), Trojan.Starter.1659 (Dr.Web), Trojan.LinkRef (Ikarus), VBS/AutoRun-UC (Sophos), VBS.Runauto (Symantec), TROJ_LINK.TJ (Trend Micro).

Explanation :

Trojan:BAT/Runner.B is a Windows shortcut file, which, when opened, runs a file, which may be detected as Trojan:VBS/Aledan.A.

Trojan:BAT/Runner.B uses the folder shortcut icon and may have the file name "Microsoft.lnk" or "New folder.lnk". The target of the shortcut file is a file named "thumbs.db", which is the file detected as Trojan:VBS/Aledan.A.

Note that "thumbs.db" is also the name of the legitimate Windows thumbnail cache file.



Analysis by Stefan Sellmer

Last update 01 November 2012

 

TOP