Autorun.KK is a worm that is downloaded onto the system from a remote server by a malicious PDF document.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Once downloaded onto the system, the malicious PDF document will also execute the worm, which will proceed to create the directory %programfiles%\Microsoft Common, then create a copy of itself as %programfiles%\Microsoft Common\svchost.exe.The worm will then use http://www.microsoft.com to check for the presence of a usable Internet connection and will then attempt to connect to http://pusto-pusto.info/[...].php?, using information on the infected machine as parameters. The website connected to may respond with further download locations, or additional instructions for the malware.
On execution, the worm will create a registry entry that allows it to execute whenever explorer.exe is launched.
Autorun.KK can spread via Windows autorun feature and by copying itself onto other drive media:
[autorun] open=system.exe shellexecute=system.exe shell\Open\command=system.exe shell=Explore
Create these directories:
Attempts to download files from:
Attempts to connect to:
Creates these keys: