Additional Details
AutoRun.GA creates a copy of itself as the following:
• C:\Program Files\Microsoft Common\wuauclt.exe
It will change the title of the process to "notepad window".
It also drops two files into the root of available removable drives:
• autorun.inf
• wuauclt.exe
It injects codes to svchost.exe and explorer.exe.
It looks for a service that will run manually and then temporarily replaces the driver with malicious driver. It then runs the service and the returns the original driver.
Launchpoint • Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Value: Debugger
Data: C:\Program Files\Microsoft Common\wuauclt.exe
This entry is created for automatic execution when explorer.exe is launched.
The autorun.inf file is an autorun file of wuauclt.exe and contains the following strings:
• [autorun]
open=system.exe
shellexecute=system.exe
shell\Explore\command=system.exe
shell\Open\command=system.exe
shell=Explore
StealthThe worm uses rootkit stealth techniques to hide its presence on the infected machine, including deleting its own installation file once the installation has been completed.