Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Autorun.INF
Threat Level Damage Distribution

At a glance


Common name:	Autorun.INF
Technical name:	W32/Autorun.INF.worm
Threat level:	Medium
Type:	Worm
Effects:	It spreads and affects other computers. It spreads , via mapped drives, through shared network resources, by infecting files that are then distributed.
Affected platforms:	Windows 2003/XP/2000/NT/ME/98/95
First detected on:	Feb. 4, 2009
Detection updated on:	Sept. 21, 2009
Statistics	No

Brief Description

Autorun.INF is a worm that spreads by copying itself, without infecting other files.

Autorun.INF uses the following propagation or distribution methods:

Exploiting vulnerabilities with the intervention of the user: exploiting vulnerabilities in file formats or applications. To exploit them successfully it needs the intervention of the user: opening files, viewing malicious web pages, reading emails, etc.
Computer networks (mapped drives): it creates copies of itself in mapped drives.
Computer networks (shared resources): it creates copies of itself in shared network resources to which it has access.
File infection: it infects different types of files, which are then distributed through any of the usual means: floppy disks, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.

Tech details

Effects

The main objective of Autorun.INF is to spread and affect other computers.

Means of transmission

Propagation via mapped drives:

Autorun.INF checks if the infected computer is connected to a network.

If so, it makes an inventory of all mapped drives and creates a copy of itself in each of them.

Propagation through shared network resources:

Autorun.INF checks if the infected computer is connected to a network. If so, it tries to spread to the shared network drives.

To do this, it tries to gain access to these shared drives, using typical or easily guessed passwords.

Distribution of infected files:

Autorun.INF does not spread automatically using its own means, but infects files of the following types:

They reach computers when previously infected files are distributed, entering computers through any of the usual channels: floppy disks, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.

Further Details

Autorun.INF has the following additional characteristics:

It is 128 bytes in size.

Solution

See solution

Autorun.INF

At a glance

Brief Description

Tech details

Effects

Means of transmission

Further Details

Solution

Call us 24/7 and get a FREE DIAGNOSIS

About Panda

Home Users

Business - WatchGuard Technologies