Home Malware Programs Worms W32/Autorun.worm.aaan

W32/Autorun.worm.aaan

Posted: March 17, 2010

W32/Autorun.worm.aaan is a malicious computer worm that tries to duplicate itself onto the root of any accessible disk drives on the targeted computer. Once active, W32/Autorun.worm.aaan will create an Autorun.inf file on the root of the drive so that it is executed each time the volume is mounted. W32/Autorun.worm.aaan also has the ability to download other malicious files onto the compromised system and cause all sorts of system malfunctions. Use a proven antivirus program to detect and remove this malicious parasite from your system.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Programfiles%\Internet Explorer\iesettings.ceb
    2 %Programfiles%\Internet Explorer\svchost.exe
    3 %SystemDrive%\autorun.inf
    4 %SystemDrive%\Run.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run]HKEY..\..\..\..{RegistryKeys}Svchost = "%Program Files%\Internet Explorer\svchost.exe"
Loading...