Home Malware Programs Worms Worm:Win32/Autorun.AAI

Worm:Win32/Autorun.AAI

Posted: November 19, 2010

Worm:Win32/Autorun.AAI is a computer worm that seeks to spread from computer to computer by copying itself to removable storage devices that infect other systems when the device is connected to them. Worm:Win32/Autorun.AAI then has the ability to download additional forms of malware onto the compromised machine. Remove Worm:Win32/Autorun.AAI as soon as it has been detected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\AvProtector.exe
    2 %AppData%\rundlll.exe
    3 %AppData%\scvhost.exe
    4 %AppData%\win32Runtime.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
Loading...