VBS.Runauto

VBS.Runauto is a Visual Basic script worm that copies itself in the root folder of all drives (including removable devices) except floppy drives.

Note: Symantec strongly recommends that customers take specific steps to control the execution of applications referenced in autorun.inf files that may be located on removable and network drives. Threats such as this one frequently attempt to spread to other computers using these avenues. Configuration changes made to a computer can limit the possibility of new threats compromising it. For more information, see the following document:

How to prevent a virus from spreading using the "AutoRun" feature

Protection

• Initial Rapid Release version March 13, 2007
• Latest Rapid Release version February 3, 2010 revision 055
• Initial Daily Certified version March 13, 2007
• Latest Daily Certified version February 4, 2010 revision 002
• Initial Weekly Certified release date March 14, 2007

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low
• Payload: Copies itself to all drives on the compromised computer.

Distribution

• Distribution Level: Low