This worm may be downloaded unknowingly by a user when visiting malicious Web sites.
It drops copies of itself.
It registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys/entries.
It searches the network for certain shares, into which it attempts to drop copies of itself. It uses a list of user names and passwords to access password-protected shares.
It connects to a certain Web site to send and receive information. It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.


More...