Worm.Win32.AutoIt.c

The worm creates the following system registry key parameters:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
DisableRegistryTools = 1
DisableTaskMgr = 1

By doing so, it prevents the registry editing tool and Task Manager from being launched.

The worm also terminates processes relating to some antivirus and firewall solutions.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Terminate the worm process by entering the following command in the command line: taskkill /IM RVHOST.exe
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Execute the following commands in the command line in order to activate the registry editor and Task Manager:

   reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
   /v DisableTaskMgr
   reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v
   DisableRegistryTools

4. In order to confirm that the parameters should be deleted, answer

   This worm creates copies of itself on local disks and write-accessible removable disks. It is a Windows PE EXE file. It is packed using UPX. The size of infected files may vary from 220KB to 275KB.

   Installation

   When launching, the worm copies its executable file to the Windows system and root directories:

   %WinDir%\RVHOST.exe
   %System%\RVHOST.exe

   In order to ensure that the worm is launched automatically when the system is rebooted, the worm adds a link to its executable file to the system registry:

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Yahoo Messengger" = "%System%\RVHOST.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Shell = "Explorer.exe RVHOST.exe"

   Propagation

   The worm copies its executable file to the root of all write-accessible removable disks under the following name:

   New Folder.exe

   The worm also recursively copies its executable file to all folders on removable disks. The copies of the worm will have the same name as the folder they have been copied to with an “.exe” extension.

   Payload