Sophos

W32/Yahlov-D

Aliases
  • Trojan.Win32.Autoit.ej
  • W32/YahLover.worm
  • Win32/Autoit.DW worm
  • WORM_AUTORUN.AB
  • Worm:AutoIt/Renocide.A
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
  • Network shares
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from January 2009 (4.37)
Protection available since 22 November 2008 05:32:32 (GMT)
Detected by All Sophos products

Action

More Information

W32/Yahlov-D is a Trojan for the Windows platform.

When first run W32/Yahlov-D copies itself to <System>\csrcs.exe and creates the following files:

<Temp>\<random characters>
<Temp>\suicide.bat

The following registry entry is created to run csrcs.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
csrcs
<System>\csrcs.exe

The following registry entry is changed to run csrcs.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe csrcs.exe

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer