We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Worm:Win32/Autorun
Aliases: No associated aliases
Summary
Windows Defender Antivirus detects and removes this threat.
This family of worms spreads by copying itself to the mapped drives of an infected PC, including network or removable drives.
The following Microsoft security software detects and removes this threat:
- Microsoft Security Essentials or, for Windows 8, Windows Defender
- Microsoft Safety Scanner
Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.
Recovering from recurring infections on a network
You might need to take the following steps to completely remove this threat from an infected network, and to stop recurring infections from network-spreading malware:
- Ensure that an antivirus product is installed on all computers connected to the network that can access or host shares.
- Ensure that all available network shares are scanned with an up-to-date antivirus product.
- Restrict permissions as appropriate for network shares on your network. See Use Access Control to restrict who can use files for more information.
- Remove any unnecessary network shares or mapped drives.
You might also need to temporarily change the permission on network shares to read-only until the disinfection process is complete.
