A、在Windows目录下生成如下文件：
%SystemRoot%\FIREWALLLOGGER.TXT
%SystemRoot%\SYSMONXP.EXE
%SystemRoot%\ZIPO0.TXT
%SystemRoot%\ZIPO1.TXT
%SystemRoot%\ZIPO2.TXT
%SystemRoot%\ZIPO3.TXT

B、在注册表主键：
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
下添加键值：
SysMonXP = "%System%\SysMonXP.exe"

从注册表主键：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
中删除以下键值：
Explorer
system.
msgsvr32
au.exe
winupd.exe
direct.exe
jijbl
Video
service
DELETE ME
d3dupdate.exe
OLE
Sentry
gouday.exe
rate.exe
Taskmon
Windows Services Host
sysmon.exe
srate.exe
ssate.exe
Microsoft IE Execute shell
Winsock2 driver
ICM version
yeahdude.exe
Microsoft System Checkup

删除以下子键：
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\PINF
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WksPatch
HKEY_CLASSES_ROOT\CLSID\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

C、该病毒感染系统后，会在本地磁盘上以下后缀的文件中搜索Email地址：
.a 　.ad 　.adb 　.as 　.asp 　.c 　.cf 　.cfg 　.cg 　.cgi 　.d 　.db
.dbx　 .dh 　.dht 　.dhtm　 .do 　 .doc 　.e 　 .em 　 .eml 　.h　　.ht
.htm 　.html 　.j 　.js 　.jsp 　.m 　.mb 　.mbx 　.md 　.mdx 　.mh 　.mht
.mm 　.mmf 　.ms 　.msg 　.n 　.nc 　.nch 　.o 　.od 　.ods 　.of 　.oft
.p 　.ph 　.php 　.pl 　.pp 　.ppt 　.r 　.rt 　.rtf 　.s 　.sh 　.sht
.shtm 　.st 　.stm 　.t 　.tb 　.tbb 　.tx 　.txt 　.u 　.ui 　.uin 　.v
.vb 　.vbs 　.w 　.wa 　.wab 　.ws 　.wsh 　.x 　.xl 　.xls 　.xm

并用其自带的SMTP引擎发送邮件给这些Email，发送的邮件具有以下特征：
主题：<从以下字符串中选择一个>
Deliver Mail <接受方邮件地址>
Delivered Message <接受方邮件地址>
Delivery <接受方邮件地址>
Delivery Bot <接受方邮件地址>
Delivery Error <接受方邮件地址>
Delivery Failed <接受方邮件地址>
Delivery Failure <接受方邮件地址>
Error <接受方邮件地址>
Failed <接受方邮件地址>
Failure <接受方邮件地址>
Mail Delivery failure <接受方邮件地址>
Mail Delivery System <接受方邮件地址>
Mail System <接受方邮件地址>
Server Error <接受方邮件地址>
Status <接受方邮件地址>
Unknown Exception <接受方邮件地址>

正文： <从以下字符串中选择一个>
Message has been sent as a binary attachment.
Modified message has been sent as a binary attachment.
Note: Received message has been sent as a binary file.
Partial message is available and has been sent as a binary attachment.
Received message has been attached.
Received message has been sent as an encoded attachment.
The message has been sent as a binary attachment.
Translated message has been attached.

以上选择的字符串后将跟随以下的字符串:

------------- failed message -------------
<随机字符>

其后将跟随以下字符串:

Delivery Agent - Translation failed
Delivery Failure - Invalid mail specification
Mail Delivery - This mail couldn't be displayed
Mail Delivery Error - This mail contains unicode characters
Mail Delivery Failed - This mail couldn't be represented
Mail Delivery Failure - This mail couldn't be shown.
Mail Delivery System - This mail contains binary characters
Mail Transaction Failed - This mail couldn't be converted

附件：<从以下字符串中选择一个>
data <随机数字>
data <随机数字>
mail <随机数字>
message
message <随机数字>
msg <随机数字>

附件后缀名：<从以下字符串中选择一个>
PIF
SCR
ZIP

该邮件不会向包含以下字符串的Email地址发送邮件：
@antivi
@avp
@bitdefender
@fbi
@f-pro
@freeav
@f-secur
@kaspersky
@mcafee
@messagel
@microsof
@norman
@norton
@pandasof
@skynet
@sophos
@spam
@symantec
@viruslis
abuse@
noreply@
ntivir
reports@
spam@

D、下图为该病毒发送邮件时的截图：


E、该病毒会使以下的图标欺骗用户：


F、在该病毒内部，还有经过加密的如下文字：
We are the only SkyNet, we don't have any criminal inspirations.
Due to many reports, we do not have any backdoors included for spam relaying.
and we aren't children. Due to this, many reports are wrong.
We don't use any virus creation toolkits, only the higher language
Microsoft Visual C++ 6.0. We want to prevent hacker,
cracking, sharing with illegal stuff and similar illegal content.
Hey, big firms only want to make a lot of money.
That is what we don't prefer. We want to solve and avoid it.
Note: Users do not need a new av-update, they need
a better education! We will envolope...

- Best regards, the SkyNet Antivirus Team, Russia 05:11 P.M -

G、如果系统时间为2004年4月8日到2004年4月11日之间，它还会对以下WEB网站发起DoS攻击：
www.edonkey2000.com
www.kazaa.com
www.emule-project.net
www.cracks.am
www.cracks.st