arrow_back
search
close

MAL_OTORUN5

October 17, 2013
 ALIASES:

Backdoor.Graybird(Symantec), Mal/Behav-058(Sophos), Backdoor.Win32.Hupigon.bhes(Kaspersky), BDS/Hupigon.Gen(Avira), W32/Downloader.C.gen!Eldorado (generic(F-Prot), W32/Autorun.worm.af.gen(McAfee)

 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 REPORTED INFECTION:

  • Threat Type: Others

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This is the Trend Micro heuristic detection for suspicious files that manifest similar behavior and characteristics as the following malware:

Since these files commonly arrive and propagate via removable drives, it is important to protect your system by first protecting your removable drive. Below are a number of options that help prevent malware from affecting or starting in your removable drive.

  1. Create a folder named AUTORUN.INF that is set to certain attributes to prevent malware from creating its own AUTORUN.INF, as most WORM_AUTORUN variants drops or overwrites a copy of the existing AUTORUN.INF. Refer to the Solution section for help in creating a folder.

  2. Enable the write-protect switch on a removable drive to allow read-only access to the removable drive. This switch is available on some removable drives. Enabling the switch prevents malware from being saved on your removable drive.

  3. Scan your removable drive with an antivirus application before opening the drive. You can use online tools such as the Trend Micro HouseCall to scan removable drives.

Files using the AUTORUN.INF file, in part, rely on the autorun or autoplay feature in Windows. This feature enables removable media such as CDs and removable drives to start automatically upon insertion or connection to the system. The following option helps prevent the spread of malware on the system:

  • Modify registry entry to disable the autorun feature. A specific registry entry is related to the autorun feature of Windows systems.

  SOLUTION

Minimum Scan Engine:

9.200

NOTES:

Creating an AUTORUN.INF Folder and Disabling Autorun Feature in Windows

This procedure enumerates the steps to create a batch (.BAT) file that creates an AUTORUN.INF folder and disables the autorun feature in Windows.

  1. Open Notepad. Click Start>Run, type NOTEPAD, then press Enter.
  2. Copy and paste the following text in Notepad:
  3. Save the created file on your Desktop as the file DISABLE.BAT.
  4. Locate the file on your desktop. Once located, double-click on the file.

Submitting Samples

If you identified suspicious files, you may submit them to us. Sample files for submission must be in ZIP format and should be password-protected. To submit a ZIP file, file compression software such as Winzip must be used. A trial version of Winzip is available here.

Note: If your Trend Micro product detects a file under this detection name, do not execute the file, or delete it immediately especially if it came from an untrusted or an unknown source (e.g., a Web site of doubtful nature). However, if you have reason to believe that the detected file is non-malicious, you can submit a sample for analysis. Detailed analysis will be done on submitted samples, and corresponding removal instructions will be provided, if necessary.

To compress a file, please follow the steps below:

  1. Right-click on the file and select Add to Zip.
  2. Enter a file name for the zip file.
  3. On the Options menu, choose Encrpyt. In the input box, type virus. This serves as the password for the zip file.
  4. Send the sample through the following channels:
    For Trend Micro Premium customers, please submit a virus support case by clicking here:
    https://success.trendmicro.com/
    For Trend Micro non-Premium customers, please contact your local support network by visiting your Trend Micro regional website.
    For non-Trend Micro customers, scan your system with HouseCall, our highly popular and capable on-demand scanner for identifying and removing viruses, Trojans, worms, unwanted browser plug-ins, and other malware.


Did this description help? Tell us how we did.