Some days ago, a friend of mine wanted few documents from me. So I plugged his pen-drive into the USB slot. As the next obvious step, I opened the drive. And strange things started happening on my computer.
First of all, I saw an executable file with its icon similar to that of a normal directory. The name of which was MicrosoftPowerPoint.exe. Note that I noticed the extension because luckily I keep the 'Hide extensions for known file types' option off. Another reason why I noticed this was because I had 'Show all files' and 'Show system files' options on.
Next, I saw an alert with some strange text on it. Now this was clearly a sign of my computer being infected with some evil code.I quickly opened the pen-drive in explorer and noticed an Autorun.inf file! Now this was the root cause of the whole problem.
It contained the following lines
Clearly, as soon as you/system opened the drive, the executable ran silently and did all the work. When I deleted the inf file and the exe file from the drive, it appeared again. Clearly a sign of something resident in memory.
Fortunately (?), the alert popped up again, and thus I was able to locate the exact process which was carrying out the whole operation.It was svchost. Now under normal circumstances, you see multiple instances of it in the task manager. The thing different about this one though was that it ran with user equal to my user name. I quickly killed the process, and deleted the two evil files on the pen drive.
As I had suspected, on rebooting my computer the alerts were seen again. Then after looking at the registry, I figured out that the worm had created a start-up entry on the system. It had copied itself at c:\heap41a.
On searching the internet for heap41a, I found the whole description of the worm.
- Pen drives are dangerous!
- Never login as privileged user when running such devices.
- Never trust your antivirus (I have free edition of AVG fully updated).
- Inf files are 'BAD'.
- Propogating such worms is as easy as spreading ajax worms (? Any thoughts)
Luckily, the worm did not do anything evil I suppose. But you may not get so lucky.