Sonicwall Signatures


Go to All Categories list.

AutoRun.VP is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. AutoRun.VP is compressed using the executable packer and its file size is 26,122 bytes. This malware is written in Borland Delphi.

It uses the network connection:

    [ Spreading through LAN/WAN ]
  • Worm spreading over a network connection.

AutoRun.VP drops the following files on the hard drive:

  • C:\WINDOWS\SYSTEM32\SVSH0ST.EXE (26122 bytes)
  • C:\sample.bat (70 bytes)
  • C:\WINDOWS\SYSTEM32\Autorun.inf (159 bytes)
  • C:\niu.exe (26122 bytes)
  • C:\autorun.inf (159 bytes)
  • N:\autorun.inf (159 bytes)
  • N:\niu.exe (26122 bytes)
It creates the following mutex to ensure only one instance is running: niux.

Relevant Information