Home Malware Programs Worms Worm.Win32.AutoRun.hkk

Worm.Win32.AutoRun.hkk

Posted: April 14, 2011

Worm.Win32.AutoRun.hkk is a self-replicating computer worm that propagates via network drives removable media, and downloads arbitrary files. Worm.Win32.AutoRun.hkk can change the corrupted system's services and compromise SafeBoot registry key(s) in a try to disable the Safe Mode. Worm.Win32.AutoRun.hkk corrupts the PC system via unsolicited spam email attachments, malicious video media codecs, pornographic related images and movie downloads.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CommonAppData%\srtserv\QMS.exe
    2 %CommonAppData%\srtserv\sdata.dll
    3 %CommonAppData%\srtserv\set.dat
    4 %CommonAppData%\srtserv\task.dat
    5 %Temp%\QMS.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MSrtn
Loading...