Selected viruses, spyware, and other threats: sorted alphabetically
Short descriptionWin32/AutoRun.Agent.RV is a worm that spreads by copying itself into the root folders of available drives. The file is run-time compressed using UPX .
InstallationWhen executed, the worm copies itself into the following location:
The following files are dropped into the %system% folder:
- %system%\IME\svchost.exe (34816 B)
The following Registry entries are created:
- help.cpp (21504 B)
- help.dll (21504 B)
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
"DllName" = "help.dll"
"Startup" = "help"
"Asynchronous" = 1
"Impersonate" = 0
SpreadingWin32/AutoRun.Agent.RV is a worm that spreads by copying itself into the root folders of available drives.
If successful the following filename is used:
The following file is dropped in the same folder:
Thus, the worm ensures it is started each time infected media is inserted into the computer.
Other informationThe worm may set the following Registry entries:
"(Default)" = ""%program files%\Internet Explorer\iexplore.exe"