Home Malware Programs Worms Worm.Win32.AutoRun.uvu

Worm.Win32.AutoRun.uvu

Posted: October 22, 2009

Worm.Win32.AutoRun.uvu is a network worm that copies itself across the network shares that use weak passwords. Worm.Win32.AutoRun.uvu sets the computer's drive to autoplay by creating the file autorun.inf in its root directory. If the drive is shared across a network, other remote computers could be compromised.

Aliases

Worm.Win32.AutoRun.uvu (Kaspersky Lab)
W32/AutoRun-CT (Sophos)
Worm.Win32.AutoRun (Ikarus)
PE_Patch.UPX (Kaspersky Lab)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CommonPrograms%\Startup\eduardo0.exe
    2 %CommonPrograms%\Startup\psvx.exe
    3 %CommonPrograms%\Startup\SinoSiBatman.exe
    4 %CommonPrograms%\Startup\VisualGayAdvance.exe
    5 %Windir%\autorun.inf
    6 %Windir%\eduardo0.exe
    7 %Windir%\judith.exe
    8 %Windir%\SinoSiBatman.exe
    9 %Windir%\VisualGayAdvance.exe
    10 c:\autorun.inf
    11 c:\judith.exe
    12 c:\SinoSiBatman.exe
    13 c:\VisualGayAdvance.exe
Loading...