W32/Autorun-KL is a worm for the Windows platform.
When executed the worm copies itself to the following files:
<Windows>\Sys32.exe
<Windows>\msservice.exe
<Windows>\backup.dll
<Root>\Config.exe
and creates the following files:
<Windows>\windrive.dll
<Windows>\itsme.ini
<Root>\Autorun.inf
The file windrive.dll is also detected as W32/Autorun-KL. The files <Windows>\itsme.ini and <Root>\Autorun.inf should be deleted.
The following registry entries are created:
HKLM\SOFTWARE\Sys \FlashDrive
C
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sys32
<Windows>\Sys32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HService
<Windows>\msservice.exe