This application requires Javascript for optimal performance.

W32/Autorun.MWB!worm - Released Sep 10, 2008 - Last Updated Sep 15, 2008

Alias/es

Worm.Win32.AutoRun.mwb(KAV), Spy-Agent.bw trojan(McAfee), WORM_AUTORUN.ASR(Trend), Worm:Win32/Emold.gen!D(MicroSoft), Trojan.Zbot-2114(ClamAV), Win32.Worm.Autorun.MF(BitDefender)

Detection Availability

Active DatabaseExtended Database
FortiGate
low
high
FortiClient
FortiMail N/A

Visible Symptoms

  • Deletes itself from the current directory.

    • Detailed Analysis


  • The behavior of this variant is very similar to W32/Agent.5190!tr.dldr.

  • Downloads data from the following URLs:
    • http://dr{removed}.ru/ld.php?v=1&rs=%u&uid=1
    • http://dr{removed}.ru/ld.php?v=1&id=%s&rs=%u&cc=0&uid=1
    • http://dr{removed}.ru/ld.php?v=1&rs=%u&n=1&uid=1
    • http://dr{removed}.ru/ld.php?v=1&id=%s&rs=%u&n=1&cc=0&uid=1
    • http://dr{removed}.ru/ld.php?v=1&rs=%u&uid=1
    • http://dr{removed}.ru/ld.php?v=1&id=%s&rs=%u&cc=0&uid=1
    • http://dr{removed}.ru/ld.php?v=1&rs=%u&n=1&uid=1
    • http://dr{removed}.ru/ld.php?v=1&id=%s&rs=%u&n=1&cc=0&uid=1

    Recommended Action

      FortiGate Systems

    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

      FortiClient Systems

    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Reference: ID - 557440