Worm.JS.AutoRun

Posted: June 14, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	52

First Seen:	June 14, 2013
OS(es) Affected:	Windows

Worm.JS.AutoRun is a worm that enables backdoor attacks against any infected PCs while Worm.JS.AutoRun distributes itself through methods that include uploading itself to FTP servers, compromising removable devices with an Autorun exploit and placing copies of itself in locations that are shared between multiple computers. Because Worm.JS.AutoRun conducts attacks that compromise your PC's security and gather exploitable information, you should treat all Worm.JS.AutoRun infections as high-level threats, and powerful security software should be used to detect and remove Worm.JS.AutoRun, which will distribute itself throughout multiple locations and protect itself with encryption.

Worm.JS.AutoRun: Running Away with Your Thumb Drive's Integrity

A JavaScript-based PC threat, Worm.JS.AutoRun is identified by a generic name but includes features that SpywareRemove.com malware experts consider anything but plain. Besides an unusually high number of distribution methods, Worm.JS.AutoRun includes functions to prevent Worm.JS.AutoRun from being detected or analyzed by various security programs (including virtual machines), collects exploitable information about your PC's software setup and shows some evidence of polymorphism (the ability to change its structure to confuse anti-malware detection).

Preventing it from being distributed in the first place is perhaps the most important aspect of countering any worm, but Worm.JS.AutoRun has more ways to infect a new PC than most worms looked over by SpywareRemove.com malware researchers. Some techniques that Worm.JS.AutoRun has been confirmed to use encompasses:

Exploiting accessible FTP accounts to upload itself.
Uploading itself to freeware and torrenting sites.
Inserting itself into the burning process for CDs and DVDs.
Creating hidden copies of itself on shared folders on your PC (folders that can be accessed by other PCs through a network).
Infecting USB-based drives and other removable devices. If you have the Autorun feature enabled, Worm.JS.AutoRun will use a common exploit to infect any new computer that accesses the infected device – even if no other interaction takes place.

Putting Your Finger Down on How to Stop Worm.JS.AutoRun

While Worm.JS.AutoRun's proliferation methods are quite substantial, SpywareRemove.com malware analysts are most concerned over Worm.JS.AutoRun's tendency to terminate itself when faced with a protected environment, as well as its ability to detect security programs and potentially attack them. Disabling Worm.JS.AutoRun through Safe Mode or any other necessary method will allow your security software to have the best chances of finding and removing Worm.JS.AutoRun's copies entirely.

Southeastern Asia is where the majority of Worm.JS.AutoRun infections have been recorded, but even PCs in other regions far from Asia – such as the United States and Australia – have been found to include double digit numbers of Worm.JS.AutoRun attacks. Attacks related to Worm.JS.AutoRun and similar worms based on both JavaScript and Java also have been noted to have risen in recent months, necessitating future emphasis on keeping all removable devices, and particularly such devices that are shared between multiple computers, secure from PC threats like Worm.JS.AutoRun.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

Java.exe

File name: Java.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file