AutoRun.ABUM is a Worm. Worms spread from computer to computer, making copies of themselves over the network. They could spread over email, IM, peer-to-peer networks, or directly over the wire by leveraging vulnerabilities. AutoRun.ABUM is compressed using the executable packer and its file size is 765,440 bytes. AutoRun.ABUM drops the following files on the hard drive: - C:\WINDOWS\system\wmibusn.exe (765440 bytes)
It also changes Windows registry: - Creates key "HKLM\Software\\Microsoft\\Windows".
- Sets value "GON"="C:\sample.exe" in key "HKLM\Software\\Microsoft\\Windows".
- Creates key "HKLM\System\CurrentControlSet\Services\WMIBUSn".
- Sets value "ImagePath"=""C:\WINDOWS\system\wmibusn.exe"" in key "HKLM\System\CurrentControlSet\Services\WMIBUSn".
- Sets value "DisplayName"="WMI-Bus NOptic" in key "HKLM\System\CurrentControlSet\Services\WMIBUSn".
AutoRun.ABUM configures following services on NT based machines: - Creates service "WMIBUSn (WMI-Bus NOptic)" as ""C:\WINDOWS\system\wmibusn.exe"".
It also contains anti-debugging code, monitors the list of running processes.
|
