Home Malware Programs Worms Worm.Win32.AutoRun.hss

Worm.Win32.AutoRun.hss

Posted: July 18, 2011

Worm.Win32.AutoRun.hss is a worm that alters Windows processes and launches malicious executable files. As a very new worm, Worm.Win32.AutoRun.hss may infect your PC in a variety of ways or use slightly different payloads. Worm.Win32.AutoRun.hss can also spread to new computers by using Autorun exploits that cause Worm.Win32.AutoRun.hss to be installed without your consent. Pay close attention to network security when you suspect that you have a Worm.Win32.AutoRun.hss infection, and use a good security program to find and remove Worm.Win32.AutoRun.hss.

Keeping Worm.Win32.AutoRun.hss Out of Your Network and Off Your PC

All worms, including Worm.Win32.AutoRun.hss, can create copies of themselves in a variety of locations. You may not see any of Worm.Win32.AutoRun.hss's duplicates, because these files have been hidden by System and Hidden flags, and even the file-viewing option to show these files may be disabled in the Registry. In addition to using randomly-named .exe files, Worm.Win32.AutoRun.hss also, as one would expect from its name, uses Autorun.inf files to make simpler the process of infecting other computers.

Worm.Win32.AutoRun.hss is very likely to infect your computer through a local network, by infecting a network-shared location. Once you access this location, Worm.Win32.AutoRun.hss can exploit Autorun.inf features and install itself without your permission or even any visible sign of the process. Having good network security and general security software, therefore, is paramount to keeping Worm.Win32.AutoRun.hss off your computer.

You may also wish to use additional caution around websites and file-sharing sources from Spain, since that country is, so far, Worm.Win32.AutoRun.hss's most likely origin point. Since Worm.Win32.AutoRun.hss has been seen infecting files in July of 2011, any anti-virus software that use updates that are older than that date may not be able to detect a Worm.Win32.AutoRun.hss infection.

The Risks You Take When You Let Worm.Win32.AutoRun.hss Wriggle Past You

Besides taking up space with its copies, Worm.Win32.AutoRun.hss will use the Registry to start itself whenever Windows launches. This allows Worm.Win32.AutoRun.hss's process to use up memory continually and launch other attacks.

Worm.Win32.AutoRun.hss has also been seen altering the explorer.exe memory process; this may conceal malicious code that disables your security or allows malicious software to run while being hidden from sight.

Although Worm.Win32.AutoRun.hss is a confirmed risk to your computer's security, Worm.Win32.AutoRun.hss's other attacks may vary depending on the .exe files that it loads. Common worm payloads include installing other harmful programs such as Trojans, recording your keyboard input to steal passwords (an attack known as 'keylogging') or disabling security programs and settings to make remote attacks on your PC easier to launch.

Using even a modern version of Windows doesn't make you immune to Worm.Win32.AutoRun.hss attacks, since it has been confirmed to attack most versions of Windows, including Windows 7. Naturally, anti-virus or security programs are the best way to find and remove Worm.Win32.AutoRun.hss, since tracking down all of Worm.Win32.AutoRun.hss's copies by hand is an error-prone exercise.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Temp%\g9EKH+EK.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{36A5A0DB-297E-FDE2-0501-060104070800}
Loading...