WORM_AUTORUN.EAY is a worm that propagates on local and remote drives. WORM_AUTORUN.EAY starts itself when volume is accessed via the autorun.inf file it created.

Aliases:

-

Risk Level: Low

File Size: Varies

Affected System: Windows

Common Symptoms:

1. Presence of the following files:

  • Backup.exe
  • Do not delete.exe
  • List.exe
  • New Folder.exe
  • Unknown artist.exe
  • Worbook 1.exe

Removal of WORM_AUTORUN.EAY Using TrendMicro’s SysClean

1. Temporarily Disable System Restore in Windows XP.

Note: You must have an Administrator Privilege to be able to disable System Restore on Windows XP. It is advised to enable it after this procedure.
a) On the Desktop, Right Click on My Computer
b) Select the System Restore Tab
c) Mark the “Turn Off System Restore” to disable and UnMark to Enable
d) Click Apply on the Bottom of the Dialog Box to save the settings.
e) A message “This deletes all existing restore points” will appear, click Yes to disable.
f) Click OK.

2. Download Sysclean, Pattern Files and Spyware Pattern Files by Trendmicro here and save them on the same directory on your Desktop. Please create a new Directory.

3. Extract the contents of the lptxxx.zip and ssapiptnXXX.zip on the folder where Sysclean is located.

6. Reboot computer in SafeMode
a) During BootUp process Press F8 continuously until selection appears
b) Use Arrow Up+Down to select SafeMode on the selections menu.
c) Hit Enter to proceed.

7. If it requires you to login please use the login name with administrative rights. Without this privilege, Sysclean will not delete/clean infected files located on System folder.

8. Browse the Sysclean folder on on your Desktop and Double-click Sysclean.exe (Sysclean.com) to run and do a full system scan. This may take time. Reboot when finished, repeat as desired to make sure that all threats are removed.