OLD WORMS DON'T GO AWAY

THEY JUST COME BACK ANOTHER DAY

TALES FROM THE VIRUS CRYPT:

Recently, someone I know ran across an old adversary - the AUTORUN.BI worm. On the radar from 2008-2011 we hadn't seen this on a customers computer for several years now, until last week!

Typically when a computer comes in with viruses a USB flash drive is popped in and various utilities are run. In this particular case my friend put his flash drive into the USB port and opened Windows Explore to view the contents of the drive. In a blink of his eye all of the utilities had changed to shortcuts [rather than actual .exe or .com files] - they were now useless. This is why techs carry a CD with utilities as well as a USB flash drive.

A quick look at the flash drive revealed that it's autorun.inf had been modified by a worm, which corrupted the files on the drive. If that flash drive had been put in another computer it would have infected it as well. Worms are a nasty lot, and here is one description of this worm taken from Microsoft:

Worm:VBS/Autorun.BI is a worm written in VBScript. It spreads by copying itself to the root of every writable drive as "nuevos !!!.hta".

Recovering from recurring infections on a network

The following additional steps may need to be taken to completely remove this threat from an infected network, and to stop infections from recurring from this and other similar types of network-spreading malware:

 

1. Ensure that an antivirus product is installed on ALL computers connected to the network that can access or host shares.
2. Ensure that all available network shares are scanned with an up-to-date antivirus product.
3. Restrict permissions as appropriate for network shares on your network. For more information on simple access control, please see: http://technet.microsoft.com/library/bb456977.aspx.
4. Remove any unnecessary network shares or mapped drives.

 

Note: Additionally it may be necessary to temporarily change the permission on network shares to read-only until the disinfection process is complete.

 

I colored part of the description in red because it's very important to note that it will copy itself to network shares [yes, your home setup is a network], meaning any drive it can write to, including:

• Other computers on your home/work wired or wireless network

• An external backup drive
• A USB flash drive 

If this was found on one computer, then it's likely to be on others so be alert!

 

'Nuff Said,

Brian