Trojan:Win32/Shipup.G

Trojan:Win32/Shipup.G is a trojan that modifies the Autorun feature for certain devices.

Trojan:Win32/Shipup.G drops itself as the following file:

• %windir%\infrom.dat

Trojan:Win32/Shipup.G may also drop a copy of itself as:

• <system folder>\ccPrxy.exe

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

It also creates a registry entry to ensure that it automatically executes every time Windows starts.

Trojan:Win32/Shipup.G disables the Autorun feature for various devices by changing the data of the following registry entry:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Value: "NoDriveTypeAutoRun"

Analysis by Andrei Florin Saygo