Virus Profile: W32/Autorun.worm.df

Virus Characteristics

Worms created using this Tool-Kit can typically drop files into the %system% folder. The worm can also drop a copy of itself along with an AutoRun.inf configuration file in all removable devices, the root of all fixed drives and the system folders.

"Autorun.inf" is a text based configuration file which instructs the Windows operating system to perform some action upon opening a network shared drive, local folder, floppy drive, CD-ROM drive or the insertion of a removable disk drive.
This configuration file is usually intended as a convenience feature, however is often misused by malware authors to create malware that spread automatically without any user interaction.

Note:

• %System% is a variable that refers to the System folder.
  By default, this is C:\Windows\System32 for Windows XP

The worm can also create a startup entry which will enable the worm’s execution at system startup. An example of such an entry would be:

• HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run
  Data: Trojan
  Value: C:\Windows\system32\trojan.exe

Miscellaneous Information:

Users who would like to prevent worms which execute without any user interaction using an “AutoRun.inf” file, can disable the Windows AutoRun feature completely with the help of the Windows group policy editor (Gpedit.msc).

ScreenShot below: