This worm may arrive via network shares. It may be downloaded unknowingly by a user when visiting malicious Web sites.
It drops a copy of itself.
It creates registry entries to enable its automatic execution at every system startup.
It disables Windows Firewall settings.
It drops copies of itself in all removable drives and in specific drives. It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.
It connects to IRC servers. It joins IRC channels. It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.
It accesses Web sites to download files. As a result, malicious routines of the downloaded files are exhibited on the affected system.


More...