W32/AutoRun.CHV Worm

Subscribe to Virus Alert
Mailing List

Enter your Email
(Ex : john@company.com)

W32/AutoRun.CHV Worm

Information about the W32/AutoRun.CHV Worm:

W32/AutoRun.CHV is a worm. The worm will infect Windows systems.

Upon execution, the worm drops the following files:

sysrest32.exe in the Windows System folder,
sysrest.sys in the Windows System folder,
amvo.exe in the Windows System folder,
amvo0.dll in the Windows System folder,
pqub.dll in the %Current Users% \temp folder.

It also drops h.cmd and autorun.inf in the root of all drives.

The worm modifies registry at the following location to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe
HKEY_CURRENT_USER\S-1-5-(SID)\Software\Microsoft\Windows\CurrentVersion\Run\amva

This worm first appeared on September 08, 2008.

Other names of W32/AutoRun.CHV Worm:

This Worm is also known as Worm/AutoRun.Y, Worm.Win32.AutoRun.chv, Infostealer.Perfwo.B, WORM_AUTORUN.XQ, Trj/QQPass.BBV.

Download the FREE Evaluation copy of Protector Plus antivirus software

About Protector Plus Antivirus Software Packages:

Proland Software is the developer of Protector Plus range of antivirus software packages. Protector Plus 2009 is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Special Offer Order Protector Plus Antivirus software Now and get SpamChoke Antispam Software worth $29.95 FREE!

Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

Click here to order
Protector Plus anti virus software