4/18: AutoRun-DJ Worm Copies Itself, Sets Registry Entry
W32/AutoRun-DJ is a worm for the Windows platform.
When run the worm copies itself to (System)\cftmonn.exe and sets the following registry entry to run itself on startup:
W32/AutoRun-DJ spreads via removable shared drives by creating the file: Root\autorun.inf (also detected as W32/AutoRun-DJ) and copying itself to Root\cftmonn.exe. This file is designed to run the worm when the removable drive is connected to an uninfected computer.
More information can be found at this Sophos page.