W32/Tupse is a worm. The worm will infect Windows systems and spreads through mapped drives.

Upon execution, the worm creates kspool.exe and avwav32.dll in the Windows System folder.

It also creates Uninstall Driver.exe and Folder.htt in the %DriveLetter%\MSSETUP.T~~ folder.

It modifies the registry at the following locations to ensure its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Then the worm modifies the %DriveLetter%\Desktop.ini file such that %DriveLetter%\MSSETUP.T~~\Folder.htt is loaded when the user opens the drive. This in turn opens the %DriveLetter%\MSSETUP.T~~\Uninstall Driver.exe file.

This worm first appeared on May 9, 2007.

 Other names of W32/Tupse Worm:

This Worm is also known as W32.Tupse.