To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.


Malware Overview
This memory-resident worm arrives via removable drives.
When executed, it drops a copy of itself in the Windows system folder. The dropped copy uses the same file name as the originally executed worm.
It also uses the icon of the normal Windows folder to trick users that it is a legitimate folder.
This worm adds a registry entry to enable its automatic execution at every system startup.
It propagates by dropping copies of itself in all removable and physical drives using the file name of its originally executed copy. It also drops an AUTORUN.INF file to automatically execute its dropped copies when the said drives are accessed.


More...