| AutoRun.WQH is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. AutoRun.WQH is compressed using the executable packer and its file size is 217,088 bytes. AutoRun.WQH drops the following files on the hard drive: |
It also changes Windows registry:
- C:\DOCUME~1\Administrator\smss.exe (217088 bytes)
- C:\autorun.inf (352 bytes)
- C:\RECYCLER\autoplay.exe (217088 bytes)
- e:\autorun.inf (352 bytes)
It also contains anti-debugging code, is executed every time Windows starts.
- Creates value "SysUtils"="C:\sample.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".
- Creates value "SysUtils"="C:\sample.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".