Worm.Win32.Autorun.ekq is a worm that spreads via local and removable media storage devices. It starts itself whenever the volume is mounted by creating and running the autorun.inf file.

MSCodecLite.7 is a malicious program that pretends as a required codec to run certain multimedia files on the internet.

“Surabaya in my birthday” is a Windows startup worm that will appear during bootup. It spreads on computer and comes embedded with File Sharing applications. It displays a message on Windows startup:
Surabaya in my birthday
Don’t kill me, i’m just send message from your computer
Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
Maafkan jika kebahagiaan yang kuminta [...]

CRYP_FAKEAV-2 is a worm that spreads on computers by mass-mailing an email with attached video file. It will prompt user to download and install a fake video codec to be able to view the video.

resycled/boot.com is a worm that propagates on local fixed and removable USB drives. resycled/boot.com may infect drives via autorun.inf file it created that runs a command each time the drive is accessed. Malicious files will be copied to a drives attached on infected computer.

Worm.MyMP3 is a worm that spreads on removable USB devices and creates a folder icon called MyMP3.vbs. It will set all infected drives to autorun so that the worm spreads easily.

W32/Autorun.worm.dw can pull malicious files from a defined websites and execute it on computer. Aside from downloader it can spread on computers with autorun.inf file.

Long Live Sowar is a modified title of Internet Explorer on computers infected with the malicious sowar.vbs.