Because your browser does not support JavaScript you are missing out on on some great image optimizations allowing this page to load faster.

Microsoft Security Intelligence

Microsoft Security Intelligence

Cart

Sign in

We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names

Published Aug 02, 2010 | Updated Sep 15, 2017

Learn about other threats

Worm:VBS/Autorun.BE

Detected by Microsoft Defender Antivirus

Aliases: VBS/SillyAutorunScript.GG (CA) VBS/Butsur.B (ESET) Worm.VBS.Agent.at (Kaspersky) VBS/Autorun.worm.k (McAfee) VBS/Worm.F (Norman) VBSAgent.NRG (Panda) Mal/VBSlog-A (Sophos) VBS.Runauto (Symantec) VBS_AUTORUN.NAA (Trend Micro)

Summary

Worm:VBS/Autorun.BE is a worm that spreads to all writable drives, lowers Windows security and downloads an arbitrary file from a predefined URL, for example "menad26.ifrance.com".

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:

Microsoft Security Essentials

Microsoft Safety Scanner

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Additional remediation instructions for Worm:VBS/Autorun.BE

This threat may make lasting changes to a computer’s configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s:

Restoring your System Registry:

For Windows 7: http://windows.microsoft.com/en-us/windows7/Back-up-the-registry
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry
For Windows XP: http://support.microsoft.com/kb/322756/

Viewing hidden and/or system files:

For Windows 7: http://windows.microsoft.com/en-US/windows7/Show-hidden-files
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Show-hidden-files
For Windows XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/win_fcab_show_file_extensions.mspx?mfr=true

Stopping and starting Windows services:

For Windows 7: http://windows.microsoft.com/en-US/windows7/What-are-Administrative-Tools
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/What-are-Administrative-Tools
For Windows XP: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sys_srv_start_service.mspx

Enabling Windows Automatic Updates:

For Windows Vista: http://windows.microsoft.com/en-US/windows/help/windows-update
For Windows XP: http://windows.microsoft.com/en-US/windows/help/windows-update

Enabling System Restore:

For Windows 7: http://windows.microsoft.com/en-us/windows7/What-is-System-Restore
For Windows Vista: http://windows.microsoft.com/en-us/windows-vista/What-is-System-Restore
For Windows XP: http://support.microsoft.com/kb/310405

Enabling Windows Security Center/Action Center alerts:

For Windows 7: http://windows.microsoft.com/en-us/windows7/What-happened-to-Windows-Security-Center
For Windows Vista: http://windows.microsoft.com/en-US/windows-vista/Using-Windows-Security-Center
For Windows XP: http://support.microsoft.com/kb/889737

Correctly disabling Autorun in Windows: http://support.microsoft.com/kb/953252
For other support and help related articles, go to:

Windows 7: http://support.microsoft.com/gp/windows7
Windows Vista: http://support.microsoft.com/ph/11732

Windows XP: http://support.microsoft.com/ph/1173

Microsoft Security TechNet Center: http://technet.microsoft.com/security/default.aspx