high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2009 (4.38) |
| Protection available since | 3 December 2008 20:00:50 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/AutoIt-AJ is a worm for the Windows platform.
When first run W32/AutoIt-AJ copies itself to <System>\csrcs.exe and creates the following files:
<Temp>\jbxupuf
<Temp>\suicide.bat
The following registry entry is created to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
csrcs
<System>\csrcs.exe
The following registry entry is changed to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe csrcs.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\DRM\amty
|
