Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Feb 11, 2008 | Updated Sep 15, 2017

Worm:Win32/Autorun.OA

Detected by Microsoft Defender Antivirus

Aliases: W32/Hupigon.BKWE (Norman) BackDoor-AWQ (McAfee)

Summary

Worm:Win32/Autorun.OA is a worm that spreads through fixed and removable drives by dropping copies of itself. It may change the computer system date, delete other programs, or connect to a remote site and await commands from a remote attacker.
Due to the process injection method of memory residency by this worm, manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan, and a basic scan of all drives using an up-to-date antivirus product such as the Microsoft Safety Scanner (http://go.microsoft.com/fwlink/?LinkId=212742). For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.
 
If the worm is not removed under normal scanning operations, rebooting to "Safe Mode with Networking" may be required, particularly if using the Microsoft Safety Scanner for removing this threat.
 
Removing Worm:Win32/Autorun.OA using Microsoft Safety Scanner in Safe Mode
  • Restart your computer in safe mode
  • Scan using Microsoft Safety Scanner
  • Restart your computer
Restart your computer in safe mode
To start your the computer in safe mode
  1. Remove all floppy disks and CDs from your computer, and then restart your computer.
  2. Press F8 after the firmware POST process completes, but before Windows displays graphical output.
    1. If Windows starts without displaying the "Please select the operating system to start" menu, restart your computer
    2. Press F8 after the firmware POST process completes, but before Windows displays graphical output.
  3. From the "Windows Advanced Options" menu, select the safe mode option "Safe Mode with Networking"
Run the Windows online scanner
  1. Visit the Microsoft Safety Scanner Web site at http://go.microsoft.com/fwlink/?LinkId=212742
  2. Click the Protection icon
  3. Click Protection Scan button

    Note: Windows safe mode sometimes uses a low resolution for the monitor display. Therefore, when the protection scan runs in safe mode, some user interface controls may not be visible. In particular, the scan Cancel button may not appear on the screen, so that it is not possible to cancel a scan after it starts. This is a known issue in the current beta release of the online scanner.
  4. Follow the prompts when the scan is complete.
Restart your computer
To restart your computer
  1. On the Start menu, click Shut Down.
  2. Select Restart from the drop-down list and click OK.
Follow us