AutoRun.WQH is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. AutoRun.WQH is compressed using the executable packer and its file size is 217,088 bytes. AutoRun.WQH drops the following files on the hard drive: - C:\DOCUME~1\Administrator\smss.exe (217088 bytes)
- C:\autorun.inf (352 bytes)
- C:\RECYCLER\autoplay.exe (217088 bytes)
- e:\autorun.inf (352 bytes)
It also changes Windows registry: - Creates value "SysUtils"="C:\sample.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".
- Creates value "SysUtils"="C:\sample.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It also contains anti-debugging code, is executed every time Windows starts.
|
