Worm:Win32/Verst.A

Worm:Win32/Verst.A is a worm that spreads via removable drives by utilizing the Autorun feature. It may also contact various remote hosts in order to download and execute arbitrary files.

When executed the malware copies itself to the following location using the same file name as the original executable:

For example, one observed instance of this worm copies itself to:

 

 

Adds value: "srtserv"
With data: <worm file>.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

For example:

 

Adds value: "srtserv"
With data: "All Users\%appdata%\srtserv\sglosrv.exe "
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

Worm:Win32/Verst.A copies itself, again using the same file name as its executable, to removable drives attached to the affected system. It then writes an autorun configuration file named 'autorun.inf' pointing to its copy. When the removable or networked drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically.