Worm:Win32/Autorun.AAI
Worm:Win32/Autorun.AAI is a worm that targets systems running Windows. Worm:Win32/Autorun.AAI propagates via removable drives; it creates an autorun.inf file which is designed to run the worm when a compromised drive is connected to an uninfected PC. Once inside a machine, it will create a start-up registry entry and deteriorate the performance of the system. It is advisable to remove Worm:Win32/Autorun.AAI from a compromised machine immediately after detection.
File System Details
Worm:Win32/Autorun.AAI may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %AppData%\scvhost.exe | |
| 2. | %AppData%\rundlll.exe | |
| 3. | %AppData%\AvProtector.exe | |
| 4. | %AppData%\win32Runtime.exe |
Registry Details
Worm:Win32/Autorun.AAI may create the following registry entry or registry entries:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
