When run W32/Autorun-EL copies itself to <System>/sys.vbs and also copies itself to all available drives to the file <Root>/sys.vbs and creates an autorun.inf file which will autorun sys.vbs.
W32/Autorun-EL will create or edit the following registry entries:
HKCU\Software\Microsoft\Internet Explorer\Main
Window Title
"Microsoft Internet Explorer"
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoFolderOptions
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
0
HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
<Target page>
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
"explorer.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe, <System>\wscript.exe <System>\sys.vbs