This worm arrives via removable drives.
It drops a copy of itself in the Windows system folder. The dropped copy uses the same file name as the originally executed worm. It uses the icon of the normal Windows folder to trick users that it is a legitimate folder.
This worm adds a registry entry to enable its automatic execution at every system startup.
It propagates by dropping copies of itself in all removable drives using the file name of its originally executed copy. It also drops an AUTORUN.INF file to automatically execute its dropped copies when the said drives are accessed.


More...