Sophos

W32/Autorun-GM

Aliases
  • Win32/AutoRun.RA
  • W32/Autorun.worm.h
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Removable storage devices
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from September 2008 (4.33)
Protection available since 20 July 2008 08:31:27 (GMT)
Detected by All Sophos products

Action

More Information

W32/Autorun-GM copies itself to <Root>\CDBoot.exe and <System>\System32.exe.

W32/Autorun-GM creates the file autorun.inf which is also detected as W32/Autorun-GM.

W32/Autorun-GM edits the registry entry:
HKCR\exefile\Shell\open\command\
(Default)
<System>\System32.exe \"%1\" %*

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer