What is TrustedSource? | Create Account | Login 
Secure Computing Corporation
 
Home  Threats and Trends  Malware Information
TrustedSource™ Query
Enter IP address, CIDR range, domain name or URL:
Search
 

Malware Information

Malware nameScript.AutoRun.AL
TypeWorm
Affected platformWin32
Media-Typeapplication/rar
MD5 checksum7B1B3E9C68A13543210B4634D5C50C77
Static fileno
Filesize4,262 Bytes
Alias names
(also known as)
SophosVBS/Autorun-AO
McAfeeW32/Autorun.worm.al
CA ETrustVBS/SillyAutorunScript.B
Side effectsDrops a file
PropagationNo own spreading routine

Description:

Files

It copies itself to the following locations:
• %WINDIR%\.vbe
• %SYSDIR%\.vbe



The following file is created:

– %malware execution directory%\012.vbs This is a non malicious text file with the following content:
• createobject("wscript.shell").run ".vbe"
Furthermore it gets executed after it was fully created.

Secure Computing Corporate Homepage | Contact | Privacy Policy | Disclaimer

Copyright © 2007-2008 Secure Computing Corporation. All Rights Reserved.

THE DATA IS FURNISHED, "AS IS" WITHOUT ANY WARRANTY OF ANY KIND, AND SECURE COMPUTING® HEREBY DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND ANY WARRANTIES AS TO NON-INFRINGEMENT, AND IN NO EVENT SHALL SECURE COMPUTING® BE LIABLE FOR COSTS OF PROCURING SUBSTITUTE GOODS. IN NO EVENT WILL SECURE COMPUTING® BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL, EXEMPLARY, OR OTHER DAMAGES WHETHER OR NOT SECURE COMPUTING® HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE.