WORM_AUTORUN.FKO

This worm drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\{ｒandom 4}\{random file name}.EXE

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following file(s)/component(s):

• %System%\{random 3}\cnvpe.fne
• %System%\{random 3}\dp1.fne
• %System%\{random 3}\eAPI.fne
• %System%\{random 3}\HtmlView.fne
• %System%\{random 3}\internet.fne
• %System%\{random 3}\krnln.fnr
• %System%\{random 3}\RegEx.fnr
• %System%\{random 3}\shell.fne
• %System%\{random 3}\spec.fne

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %System%\{random 1}
• %System%\{random 2}
• %System%\{random 3}
• %System%\{random 4}

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\｛random file name}.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• Recycle.exe

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun]
open=Recycle.exe
shell\1=´ò¿ª(&O)
shell\1\Command=Recycle.exe
shell\2\=ä¯ÀÀ(&B)
shell\2\Command=Recycle.exe
shellexecute=Recycle.exe