CRYP_EMBED4

This is the Trend Micro heuristic detection for suspicious files that manifest similar behavior and characteristics as the following malware:

• WORM_EMBEDED
• WORM_AUTORUN

AUTORUN is a family of worms that propagates through physical, removable and network drives and leaves a file named AUTORUN.INF. This file is used to automatically execute the malware each time the infected drive is accessed.

Variants of AUTORUN are also capable of downloading other malware, compromising the affected computer's security by way of having backdoor routines, and disabling security related applications or services by way of process termination.

Some AUTORUN variants are known as FUJACKS. These variants are file infectors that spread using the same AUTORUN propagation methods, and it also infects certain file types as additional means of spreading.

If your Trend Micro product detects a file under this detection name, do not execute the file. Delete it immediately especially if it came from an untrusted or an unknown source (e.g., a Web site of doubtful nature). However, if you have reason to believe that the detected file is non-malicious, you can submit a sample for analysis. Detailed analysis will be done on submitted samples, and corresponding removal instructions will be provided, if necessary.