W32/Autorun.worm!ke is detection for malware that attempts to spread using autorun methods.

When executed, the Worm copies itself into the following locations:

• %WINDIR%\system32\Explores.exe [Hidden]
• %WINDIR%\system32\Hyden.dll.exe [Hidden]
• %WINDIR%\system32\Twain32.dll.exe [Hidden]
• %WINDIR%\Hyden.dll.exe [Hidden]
• %WINDIR%\Twain32.dll.exe [Hidden]

**Where %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)]

An autorun.inf file is dropped into the root of all removable drives and mapped drives in an attempt to autorun an executable when the drive is accesed.

The file "AutoRun.inf" is pointing to the malware binary executable, when the removable or networked drive is accessed from a machine supporting the Autorun feature, the malware is launched automatically.

The following registry values have been added and the below mentioned registry ensures that, the Trojan registers itself with the compromised system and execute itself upon every boot.

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
        explorador = "%WINDIR%\Hyden.dll.exe"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\]
        搈atriz� = "explorer.exe Twain32.dll.exe"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\KnownDLLs\]
        hyden = "Hyden.dll.exe"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs\]
        hyden= "Hyden.dll.exe"