My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Worm.VBS.Solow.A

VERY LOW
VERY LOW
3642
(Worm.VBS.Slogod)

Symptoms

Presence of MS32DLL.DLL.VBS file in %WINDIR% directory and in root directories of removable and fixed drives with hidden and system attributes.
Presence of autorun.inf in root directories of removable and fixed drives with hidden and system attributes.

Removal instructions:

Please let BitDefender disinfect your files.

Analyzed By

Suiu Andrei, virus researcher

Technical Description:

Once executed, the worm replicated copying itself in %WINDIR% directory and in root directories of all fixed and removable disk drives except A: drive. After that it creates autorun.inf on all fixed and removable drives except A: drive and sets the worm to be executed at disk autorun.

Also the worm sets Main Window Title of Internet Explorer to: "Hacked by Godzilla", and executes explorer.exe with infected filename argument, thus executing itself in an infinite cycle, this way every time you intoroduce a new removable drive, it infects it.