Worm:W32/AutoRun.CNS
Summary
Worm.Win32.AutoRun.cns attempts to deliver its payload on the 21st of each month. It will render the system unusable by deleting the system files. This worm also spreads via removable drives and terminates system processes as well as antivirus processes.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Upon execution, Autorun.CNS will check to see if the date is the 21st of the month. If so, it will then proceed with its payload.If it is not the 21st of the month, Autorun.CNS will perform the following actions:
It creates an autorun registry entry.It checks if %windir%\autorun.inf exists and then modifies it to point to itself. It then set the attributes to +R+H+S (read-only, hidden, system).
- [autorun]
- open=explorcr.exe
- shellexecute=explorcr.exe
The following files will then be copied to all discovered fixed and removable drives:
- %windir%\autorun.inf
- %original path%\explorcr.exe
It makes a copy of itself to the windows system folder, usually C:\Windows\System32.It changes the attribute of file %windir%\wininit.exe to read-only.It change the attributes of file %windir%\explorcr.exe to +R+H+S (read-only, hidden, system).It deletes the following files from the Program Files directory:
- ESET\nod32.exe
- ESET\nod32krn.exe
- ESET\nod32kui.exe
Payload
On the 21st of the month, Autorun.CNS will attempt the actions listed below.Autorun.CNS displays a "HAPPY BIRTHDAY" tool tip below the mouse pointer.It terminates the following processes if they are running or upon execution:
- cmd.exe
- handydriver.exe
- kerneldrive.exe
- nod32krn.exe
- nod32kui.exe
- winsystem.exe
- Wscript.exe
It looks for the following files (which usually are available).
- %windir%\win.ini
- %windir%\system.ini
- c:\ntldr
If the files are discovered, it will display a decoy message box showing a progress bar with the following string:
- Wait! Now rnning antivirus killer.
It then deletes the files.
Autorun.CNS creates registry entries so that users cannot use:
- Registry editor
- Task manager
If the applications listed below are started, the user will be given a "Security Check" dialog box asking for administrator password.
If the password is incorrect, it will produce a long beeping sound.Applications:
- msconfig.exe
- rstrui.exe
- regedit.exe
After providing the correct password, the computer will be forced to restart. This will render the computer unusable since important system files are deleted.
Additional Information
This worm comes compiled by AutoIt v3.