This worm may be dropped by other malware. It may arrive via removable drives.

It creates a folder. It drops a copy of itself and component files. It also drops files which Trend Micro detects as CRYP_XED-6 and TSPY_ONLINEG.BWN. As a result, routines of the dropped files are also exhibited on the affected system.

It creates registry entries to enable its automatic execution at every system startup. It modifies registry entries to hide files with both System and Read-only attributes.

This worm drops copies of itself in all physical and removable drives. It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.



More...