Home / malware

PDF

Win32.Worm.Autoit.AL

First posted on 21 November 2011.
Source: BitDefender

Aliases :

There are no other names known for Win32.Worm.Autoit.AL.

Explanation :

This worm tries to impersonate a friendly application one that wants to protect your removable drives from other pieces of malware.

The malicious file would copy itself to %programfiles%FlashGuardFlashGuard.exe

It also includes a readme file that reads:
"This tiny software is used to protect removable storage devices from
worms that are spread from one PC to another. "

It creates the following registry keys:
HKLMSoftwareMicrosoftWindowsCurrentVersionRunFlashGuard
with the value "%windrive%FlashGuardFlashGuard.exe" -run

HKCUSoftwareMicrosoftWindowsCurrentVersionRunFlashGuard
with the value "%windrive%FlashGuardFlashGuard.exe" -run

Copies the readme file to %windrive%FlashGuardReadMe.txt

It checks if any of the following processes are running,
iexplore.exe,alg.exe,csrss.exe,cssrs.exe,cssrss.exe,explore.exe,
expIorer.exe,csrss.exe,iexplorer.exe,lexplore.exe,lsass.exe,lssas.exe,
lssass.exe,scshost.exe,scvhost.exe,scvhsot.exe,smss.exe,smsss.exe,
spoolss.exe,spoolsv.exe,spoolvs.exe,ssms.exe,sssms.exe,ssvhost.exe,
svchost.exe,svchsot.exe,serivces.exe,taskmgr.exe,wilnogon.exe,winl0g0n.exe,
winlgoon.exe,winlogno.exe,winlogon.exe,wlnlogon.exe
and if is not one of:
Program FilesInternet Exploreriexplore.exe,
system32svchost.exe,
system32lsass.exe,
system32csrss.exe,
system32alg.exe,
system32winlogon.exe,
system32smss.exe,
system32spoolsv.exe,
system32 askmgr.exe
the process would terminated and the file would get renamed with a ".bak" extension

this worm will remove all files from C:heap41a that are related to other malicious programs

it enables TaskManager if is disabled

will infect any removable drive writing autorun.inf and a copy of itself
in %drv%SystemSecurityDriveGuard.exe with hidden attribute

payload:

will download from http://[removed]/lndexnew.jpg
and http://[removed]/lndexnew.txt
executable files that will be copied to temporary directory with a random name
and reg key HKLMsoftwaremicrosoftwindowscurrentversionRunOnce emp_cleanup
with value "%temp_path%[random].exe" will be created
All downloaded files are backdoors

Last update 21 November 2011

 

TOP