VBS_AUTORUN.CFQ

This worm arrives via removable drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives via removable drives.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\.vbe
• %Windows%\.vbe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
explorer\run
{machine name} = ".vbe"

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\{machine name}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{machine name}
til = "Raider 8.05"

HKEY_LOCAL_MACHINE\SOFTWARE\{machine name}
tjs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{machine name}
djs = "{date of first execution}"

HKEY_LOCAL_MACHINE\SOFTWARE\{machine name}
ded = "0"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\.vbs

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

Raider 8.05
[AutoRun]
open=wscript .\.vbs
shell\open\command=wscript .\.vbs
shell\open\default=1