W32/AutoInf-AB is a worm for the Windows platform.
W32/AutoInf-AB spreads by copying itself to removeable storage devices and creating the file autorun.inf.
When W32/AutoInf-AB is installed it creates the file <Windows>\sysdiag64.exe.
The following registry entries are created to run sysdiag64.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
MicrosoftCorp
<Windows>\sysdiag64.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MicrosoftNAPC
<Windows>\sysdiag64.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
sysdiag64.exe
<Windows>\sysdiag64.exe