VBS/AutoRun-XK is a worm for the Windows platform.
When run VBS/AutoRun-XK creates the files:
Documents and Settings\(User)\Templates\exec01.bat
Documents and Settings\(User)\Templates\exec02.bat
Documents and Settings\(User)\Templates\myeclass.JPEG.dll.vbs
Root\my.vbs.bat
User\Desktop\payload.vbs
User\Desktop\payload.bat
System\myeclass.JPEG.dll.vbs
These files are detected as VBS/AutoRun-XK.
VBS/AutoRun-XK spreads via removable shared drives by copying itself as Root\myeclass.JPEG.dll.vbs and creating the file Root\autorun.inf.
More information can be found at this Sophos page.
Loading Comments...