[阅读: 644] 2004-12-02 07:10:16
When W32.Setclo runs, it performs the following actions:
Creates a copy of itself as C:\SETUP.EXE.
Creates a file named C:\AUTORUN.INF, which starts SETUP.EXE when the computer starts up.
Copies SETUP.EXE and AUTORUN.INF to all mapped network drives.
Adds the value:
"svchost"="[Path to file]\SETUP.EXE"
to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
so that the worm starts when Windows starts.