Information about the W32/AutoRun.YIM Worm:

W32/AutoRun.YIM is a worm. The worm will infect Windows system.

Upon execution, the worm drops the following files in the Windows\System32 folder:

users.exe
svchosts.exe
lnkstfb.exe
imaps.exe
winflags.scr

It also drops the following files:

BOOTSECT.exe in root of Windows installed drive
settings.exe in Windows folder
WindowsUpdate.exe in Program Files folder
MSConfig.exe in Windows\PCHEALTH\HELPCTR folder
HotKeyDrive.exe in Documents and Settings\All Users\Start Menu\Programs\Startup folder

The worm disables the following Windows Applications:

Control Panel
RegistryTools

It also disables Folder Options.

The worm modifies registry at the following locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXX\Software\Microsoft\Windows\CurrentVersion\Run

This worm information updated on July 9, 2009.

 Other names of W32/AutoRun.YIM Worm: