W32/AutoRun-DJ is a worm for the Windows platform.

When run the worm copies itself to (System)\cftmonn.exe and sets the following registry entry to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cftmonn
System\cftmonn.exe


W32/AutoRun-DJ spreads via removable shared drives by creating the file: Root\autorun.inf (also detected as W32/AutoRun-DJ) and copying itself to Root\cftmonn.exe. This file is designed to run the worm when the removable drive is connected to an uninfected computer.

More information can be found at this Sophos page.