The Trojan copies its executable file to all removable media under the following name:
It also copies the extracted image:
<x> stands for the letter of the removable disk.
The Trojan creates an autorun.inf file in the root of the removable disk. This file will automatically launch the Trojan executable file when the user attempts to open the infected disk using Explorer.
The Trojan also recursively copies its executable file to all folders on the removable disk. These copies use the names of files which are located in these folders together with an .exe extension.