Malware type: Worm
Aliases: Virus.Win32.AutoRun.nh (Kaspersky), Generic.dx (McAfee), W32.Dotex (Symantec), TR/Crypt.NSPM.Gen (Avira), Mal/Emogen-N (Sophos),
In the wild: Yes
Destructive: No
Language: English
Platform: Windows 98, ME, NT, 2000, XP, Server 2003
Encrypted: No
Overall risk rating:
Low
Reported infections:
Low
Damage potential:
Medium
Distribution potential:
Medium
Infection Channel 1 : Propagates via removable drives
Infection Channel 2 : Copies itself in all available physical drives
Description:
This worm may be dropped by other malware. It may arrive via network shares. It may also be downloaded unknowingly by a user when visiting malicious Web sites.
Upon execution, this worm drops several copies of itself. It also drops several non-malicious files. This worm then creates registry entries to enable its automatic execution at every system startup.
It executes a dropped file every time certain files types are called. It does the said routine by creating certain registry keys and entries.
This worm drops copies of itself in all physical and removable drives. It also drops an AUTORUN.INF file to automatically execute its dropped copies when the said drives are accessed.
This worm accesses URLs to download certain files. However, the said URLs are currently unavailable as of this writing. It also terminates certain processes, if found running in memory.
