W32/AutoRun-AEO is a worm for the Windows platform.
When first run W32/AutoRun-AEO copies itself to:
%System%\services.exe
%Documents and Settings%\user\StartMenu\Programs\Startup\kbddrv32.com
Registry entries are set (appended - modified) as follows:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
"<OldParametr> C:\\WINDOWS\\services.exe"
W32/AutoRun-AEO spreads via removable shared drives by copying itself to %Root%\1.bat and creating the file %Root%\autorun.inf. The file %Root%\\autorun.inf is designed to run the worm (1.bat) when the removable drive is connected to an uninfected computer.