Sophos

W32/AutoRun-DI

Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 18 April 2008 01:59:33 (GMT)
Detected by All Sophos products
Sophos beta program Sophos beta program
Register now for our latest beta tests
  • Endpoint Security and Control 9.0
  • Small business solutions 4.0

Action

More Information

W32/AutoRun-DI is a worm for the Windows platform that spreads via removable drives.

When run copies itself to:
<Documents and Settings>\<User>\cftmon.exe
<System>\drivers\spools.exe

W32/AutoRun-DI sets the following registry entries to run itself on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
autoload
<Documents and Settings>\<User>\cftmon.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
<ntuser>
<System>\drivers\spools.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
autoload
<Documents and Settings>\<User>\cftmon.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<ntuser>
<System>\drivers\spools.exe

HKCR\exefile\shell\open\command
(default)
<System>\drivers\spools.exe "%1" %*

HKLM\SYSTEM\CurrentControlSet\Services\Schedule
ImagePath
<System>\drivers\spools.exe

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer