VirTool:INF/Autorun.gen!H

VirTool:INF/Autorun.gen!H is a generic detection for the "autorun.inf" configuration data file that performs automated actions associated with removable media drives. One such action is to open an executable named "\BUMARA\darica.exe" when the drive is first initialized or accessed and Autorun is enabled.

VirTool:INF/Autorun.gen!H is installed and associated with worms that spread by means of removable drive media. This Autorun configuration file is commonly found in the root of the infected removable media and contains text instructions which are executed when such media is first attached or inserted in to the system and Autorun is enabled.

When such media is first attached or inserted in to the system and Autorun is enabled, INF/Autorun.gen!H runs an accompanying file named "\BUMARA\darica.exe", also located on the removable drive.

 

The VirTool:INF/Autorun.gen!H also changes the default double-click behavior for the removable drive and its icon, which is shown as a closed-folder icon, hence suggesting a double-click action to open it when viewed by Windows Explorer. If the drive is opened via a double-click (or by pressing the Enter key), the file "\BUMARA\darica.exe" is executed.

The file "\BUMARA\darica.exe" is commonly associated with the Win32/Rimecud worm.