Win32/AutoRun.VB.GJ [Threat Name] go to Threat

Win32/AutoRun.VB.GJ [Threat Variant Name]

Category worm
Size 57344 B
Detection created Oct 07, 2009
Detection database version 4488
Aliases Worm.Win32.VBNA.a (Kaspersky)
  VBObfus.trojan (McAfee)
  Worm:Win32/Vobfus.F (Microsoft)
  W32.Changeup (Symantec)
Short description

Win32/AutoRun.VB.GJ is a worm that spreads via removable media.

Installation

When executed, the worm copies itself into the following location:

  • %profile%\­%variable%.exe

In order to be executed on every system start, the worm sets the following Registry entry:

  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "%variable%" = "%profile%\­%variable%.exe"

A string with variable content is used instead of %variable% .


The following Registry entry is set:

  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Explorer\­Advanced]
    • "ShowSuperHidden" = 0
Spreading on removable media

The worm copies itself into the root folders of removable drives using the following names:

  • %originalmalwarefilename%.exe
  • %originalmalwarefilename%.scr

The following file is dropped in the same folder:

  • autorun.inf

The AUTORUN.INF file contains the path to the malware executable.


Thus, the worm ensures it is started each time infected media is inserted into the computer.


The worm creates the following files:

  • %removabledrive%\­New Folder.lnk
  • %removabledrive%\­Passwords.lnk
  • %removabledrive%\­Documents.lnk
  • %removabledrive%\­Pictures.lnk
  • %removabledrive%\­Music.lnk
  • %removabledrive%\­Video.lnk

These are shortcuts to files of the worm .

Other information

The worm acquires data and commands from a remote computer or the Internet.


The worm generates various URL addresses. The HTTP protocol is used.


It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files

The worm hooks the following Windows APIs:

  • TerminateProcess (kernel32.dll)
  • TerminateThread (kernel32.dll)

It avoids processes which contain any of the following strings in their path:

  • alg.exe
  • csrss.exe
  • firefox.exe
  • lsass.exe
  • services.exe
  • smss.exes
  • spoolsv.exe
  • svchost.exe
  • winlogon.exe
  • explorer.exe

Please enable Javascript to ensure correct displaying of this content and refresh this page.