high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Included in our products from | January 2009 (4.37) |
| Protection available since | 22 November 2008 05:32:32 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Autorun-QA is a worm for the Windows platform.
When first run W32/Autorun-QA copies itself to <System>\XP-<random characters>.EXE and creates the following files:
<Temp>\e_4\com.run
<Temp>\e_4\dp1.fne
<Temp>\e_4\eAPI.fne
<Temp>\e_4\internet.fne
<Temp>\e_4\krnln.fnr
<Temp>\e_4\RegEx.fnr
<Temp>\e_4\shell.fne
<Temp>\e_4\spec.fne
The file eAPI.fne is detected as Mal/Behav-010. The other files are all detected as W32/Autorun-QA.
W32/AutoRun-QA may copy itself to removable drives as the file Recycled.exe and create the file Autorun.inf detected as Mal/AutoInf-A. If there any directories on the removable drive, they will be set to Hidden and W32/AutoRun-PZ will be copied to the drive as <Folder name>.exe.
|
