W32/Autorun.worm.aaan
W32/Autorun.worm.aaan is a Windows platform worm that copies itself to the root of any accessible disk volumes. W32/Autorun.worm.aaan creates an autorun.inf file in the root of the volume thus ensuring that it is executed each time the volume is mounted. Once inside a system, W32/Autorun.worm.aaan will create a copy of itself in the system then it will attempt to connect with a number of remote URLs. W32/Autorun.worm.aaan will also modify the registry to ensure that it is run whenever Windows is restarted.
File System Details
W32/Autorun.worm.aaan may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %SystemDrive%\Run.exe | |
| 2. | %Programfiles%\Internet Explorer\svchost.exe | |
| 3. | %SystemDrive%\autorun.inf | |
| 4. | %Programfiles%\Internet Explorer\iesettings.ceb |
Registry Details
W32/Autorun.worm.aaan may create the following registry entry or registry entries:
Svchost = "%Program Files%\Internet Explorer\svchost.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run]
