Worm.Cinera.A

Worm.Cinera.A is a self-replicating computer worm based on VBScript. It infects computers through removable drives which means that you always have to perform a scan of a USB flash or any other removable drive before plugging it into your computer. Worm.Cinera.A can also infect your drive when you are using it in a library or any other place for collectively used computers. The danger lies in the fact, that even though the worm does not infect your files it can replicate and come with a payload that would significantly decrease your computer performance.

When the infected removable drive is plugged into the system, Worm.Cinera.A checks whether there’s a copy of it present. If not, the worm drops a copy of itself in one of the system folders (System 32), creating a file with the .vbs extension. The name for the file is generated randomly, and the filename list is still not full, but Worm.Cinera.A has been come across as Syso.vbs, scvhosteyobogbai.vbs., NetService.vbs and so on. The worm can also install an autorun file that makes the application run automatically every 3 minutes until midnight.

The worm is also very good at hiding itself, because it can change its VBS file icon into something that looks absolutely harmless. For example, Worm.Cinera.A is known to switch VBS icon to an MP3 or JPEG file icon. It adds subkeys into the registry, making it a default icon for its file and subsequently “disappearing” into the overall mass of files that you consider absolutely normal. Another thing that Worm.Cinera.A does commonly is dropping an image file into the system folder, displaying a fake black-and-white image of 100 dollars note, saying “The Bogus States of America”. Clearly, this image is one of the best indications that the system has been infected with Worm.Cinera.A and if you happen to come across this image in your system, you need to get yourself a reliable antimalware program and deal with Worm.Cinera.A immediately.

Even though manual worm removal is possible, it is very difficult, and the longer you wait, the slower your system becomes. Therefore, it would be for the best to remove Worm.Cinera.A automatically, allowing the safeguard application to scan your computer for any other malware applications present. And don’t forget to check your removable drive for any infections as well.