A、
1、将自身复制到系统安装目录下生成如下文件：
%SystemRoot%\system32\upu.exe

2、找到KaZaA的共享目录，并将自身复制成以下文件之一：
AVP5.xcrack.exe
hx00def.exe
ICQBomber.exe
InternetOptimizer1.05b.exe
Shrek_2.exe
UnNukeit9xNTICQ04noimageCrk.exe
YahooDBMails.exe

3、找到网络共享目录，并将自身复制成以下文件之一：
hx00def.exe
ICQBomber.exe
InternetOptimizer1.05b.exe
Shrek_2.exe
UnNukeit9xNTICQ04noimageCrk.exe
YahooDBMails.exe

B、
1、在注册表主键：
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
下添加如下键值：
"NvClipRsv" = "%SystemRoot%\system32\upu.exe"

C、在%SystemRoot%\system32\drivers\etc\目录下的文件hosts中添加如下内容：
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads-eu1.kaspersky-labs.com

D、使用“Expletus”互斥体，来判断自己是否已经运行。

E、开窍TCP135和TCP445，并监听1250和一个随机端口

F、搜索硬盘中所有以htm、html、php、tbb、txt为后缀名的文件，从中查找E-Mail地址。

G、使用自己的SMTP引擎，向找到的E-Mail地址发信。发信内容如下之一：
Subject: RE: order
Message:
Hi.
Here is the archive with those information, you asked me.
And don't forget, it is strongly confidencial!!!
Seya, man.

P.S. Don't forget my fee ;)
Attachment: SecUNCE.exe

Subject: For you
Message:
Hi, my darling :)
Look at my new screensaver. I hope you will enjoy...
Your Liza
Attachment: AtlantI.exe

Subject: Hi, Mike
Message:
My friend gave me this account generator for http: //www.pantyola.com I wanna share it with you :)
And please do not distribute it. It's private.
Attachment: AGen1.03.exe

Subject: Good offer.
Message:
Greets! I offer you full base of accounts with passwords of mail server yahoo.com. Here is archive with small part of it. You can see that all information is real. If you want to buy full base, please reply me...
Attachment: demo.exe

Subject: RE:
Message:
Hi, Nick. In this archive you can find all those things, you asked me.

See you. Steve
Attachment: release.exe