Selected viruses, spyware, and other threats: sorted alphabetically

Win32/AutoRun.Autoit.CT

Aliases:	Generic2_c.PPF (AVG), Autoit_gen.A (Norman)
Type of infiltration:	Worm
Size:	1137995 B
Affected platforms:	Microsoft Windows
Signature database version:	5168 (20100603)

Win32/AutoRun.Autoit.CT is a worm that spreads via removable media. The worm contains a backdoor. It can be controlled remotely.

When executed, the worm creates the following files:

In order to be executed on every system start, the worm sets the following Registry entries:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
Run]
"Cyswin" = "%windir%cyswin.exe"
"Cysrun" = "%windir%cysrun.exe"

The following Registry entries are set:

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
ExplorerAdvanced]
"Hidden" = 2
"ShowSuperHidden" = 0

The worm copies itself into the root folders of removable drives using the following filename:

The following file is dropped in the same folder:

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The worm acquires data and commands from a remote computer or the Internet.

The worm connects to the following addresses:

The IRC protocol is used.

It can execute the following operations:

The worm collects the following information:

The worm can send the information to a remote machine.

The following programs are terminated:

The worm terminates any program that creates a window containing any of the following strings in its name:

The worm may create the following files: