When first run W32/AutoRun-AEO copies itself to:
%System%services.exe %Documents and Settings%userStartMenuProgramsStartupkbddrv32.com
Registry entries are set (appended - modified) include the following:
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon
Shell
"
More information can be found at this Sophos page.
Loading Comments...