W32/AutoRun.Cpi is a worm. The worm will infect Windows systems and spreads through removable drive and network drives.

The worm will arrive as a dropped file from the network or removable drive.

Upon execution, the worm copies itself as auto.exe, autorun.inf in Root of windows installed folder, system.exe in Windows folder and Explorer.exe in Startup folder.

The worm modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

It also copies auto.exe and autorun.inf in the removable drives.

The worm modify windows registry to disable Folder options and Windows Registry editor.

The worm sets home page of Internet Explorer to http://cli[removed]nu.com

The affected system will not boot in safe mode.

The worm is capable of disabling some security related applications.

The worm terminate running processes like Command Prompt or Task Manager in the affected system.

This worm first appeared on March 15, 2008.

 Other names of W32/AutoRun.Cpi Worm:

This Worm is also known as TR/Crypt.CFI.Gen, Worm.Autorun.Delf.H, Worm.AutoRun.aij, Win32.AutoRun.cpi, Worm.Win32.AutoRun.cpi, W32/ManClick.A.worm, W32/Autorun-BC.