This worm drops several files, some of which are detected as TROJ_NSANTI.FW.
A dropped .DLL component is then injected as thread into running processes, particularly EXPLORER.EXE, for it to remain memory-resident. This makes it difficult to terminate. The dropped .DLL component also serves as the information-theft and propagation component.
This worm drops copies of itself in all physical and removable drives. It also drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.
This worm monitors the following processes to steal sensitive information, such as user names and passwords, related to certain online games.

This worm accesses a URL to download an updated version of itself. It then executes the downloaded file. As a result, new behaviors of this worm may be exhibited on the affected system. It then adds a registry key and entry to record its latest version.

More...