A、拷贝其本身至以下位置：
%Root%\COMMAND.EXE
%System%\IEXPLORE.EXE
%System%\RAVMOND.exe
%System%\WINHELP.EXE
%systemRoot%\SYSTRA.EXE
%System%\KERNEL66.DLL
%Root%\AUTORUN.INF

B、在系统目录释放以下后门组键程序：
LMMIB20.DLL
MSJDBC11.DLL
MSSIGN30.DLL
ODBC16.DLL

C、在系统根目录下生成以下名称的文件（在以下字符串中选择一个）：
BAK
BOOK
EMAIL
IMPORTANT
LETTER
PASS
PASSWORD
SETUP
WORK
后缀名可能为:.zip或.rar，其中包含的文件后缀可能为：EXE，COM，PIF，SCR

D、该病毒还会在局域网中具有写权限的共享目录中拷贝其本身，使用以下文件名：
100 free essays school.pif
Age of empires 2 crack.exe
AN-YOU-SUCK-IT.txt.pif
Are you looking for Love.doc.exe
autoexec.bat
CloneCD + crack.exe
How To Hack Websites.exe
Mafia Trainer!!!.exe
MoviezChannelsInstaler.exe
MSN Password Hacker and Stealer.exe
Panda Titanium Crack.zip.exe
Sex_For_You_Life.JPG.pif
SIMS FullDownloader.zip.exe
Star Wars II Movie Full Downloader.exe
The world of lovers.txt.exe
Winrar + crack.exe

E、在以下注册表主键中添加如下键值：
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
Run = RAVMOND.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTra = %Windows%\SysTra.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
WinHelp = %System%\WinHelp.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Program In Windows = %System%\IEXPLORE.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
VFW Encoder/Decoder Settings = RUNDLL32.EXE MSSIGN30.DLL ondll_reg

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Protected Storage = RUNDLL32.EXE MSSIGN30.DLL ondll_reg

HKEY_LOCAL_MACHINE\Software\Classes\AutoRun\2\Shell\AutoRun\command
Default = "C:\COMMAND.EXE" /StartExplorer

同时，它还会添加以下子键：
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Windows Management Protocol v.0 (experimental)
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\_reg

F、该病毒会使用其自带的MAPI来回复所有在本地系统中可以找的邮件，回复的邮件具有以下特征：
主题: Re: <原邮件主题>

正文:
<原邮件正文>
<域名> auto-reply:
If you can keep your head when all about you
Are losing theirs and blaming it on you;
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or, being lied about,don't deal in lies,
Or, being hated, don't give way to hating,
And yet don't look too good, nor talk too wise;
... ... more look to the attachment.
> Get your FREE <域名> now! <

附件: (以下字符串之一)

·Britney spears nude.exe.txt.exe
·Deutsch BloodPatch!.exe
·dreamweaver MX (crack).exe
·DSL Modem Uncapper.rar.exe
·How to Crack all gamez.exe
·I am For u.doc.exe
·Industry Giant II.exe
·joke.pif
·Macromedia Flash.scr
·Me_nude.AVI.pif
·s3msong.MP3.pif
·SETUP.EXE
·Sex in Office.rm.scr
·Shakira.zip.exe
·StarWars2 - CloneAttack.rm.scr
·the hardcore game-.pif

同时，它还可以利用自带的SMTP引擎来向从以下搜索到的Email地址发送邮件:
HKEY_LOCAL_MACHINE\Software\Microsoft\WAB\WAB4\Wab File Name

它还会从temporary Internet files folder中具有以下后缀名的文件中来搜索域名和Email地址:
adb
asp
dbx
htm
php
sht
tbb
wab

它将不会向包含以下字符串的邮件地址发送邮件:
.gov
.mil
acketst
arin.
borlan
bsd
example
fido
foo.
fsf.
gnu
google
gov.
hotmail
iana
ibm.com
icrosof
ietf
inpris
isc.o
isi.e
kernel
linux
math
mit.e
mozilla
msn.
mydomai
nodomai
panda
pgp"
rfc-ed
ripe.
ruslis
secur
sendmail
sopho
syma
tanford.e
unix
usenet
utgers.ed
accoun
anyone
bsd
bugs
ca
certific
contact
feste
gold-certs
google
help
icrosoft
info
linux
listserv
me
no
nobody
noone
not
nothing
ntivi
page
postmaster
privacy
rating
samples
service
site
soft
somebody
someone
submit
support
the.bat
unix
webmaster
you
your

该病毒还会向由以下字符串及其搜索到的域名生成的邮件地址发送邮件:
adam
alex
alice
andrew
anna
bill
bob
bob
brenda
brent
brian
claudia
dan
dave
david
debby
fred
george
helen
jack
james
jane
jerry
jim
jimmy
joe
john
jose
julie
kevin
leo
linda
maria
mary
matt
michael
mike
peter
ray
robert
sam
sandra
serg
smith
stan
steve
ted
tom

由SMTP服务器决定，该病毒还会在它搜索到的域名前添加以下字符串:
gate.
mail.
mail1.
mx.
mx1.
mxs.
ns.
relay.
smtp.

该病毒还会假设搜索到的域名具有邮件服务器，并与其在端口２５建立连接。当连接失败时，才会使用其自带的SMTP服务器来替代．

它通过这种途经发送的邮件具有以下特征：

主题（以下字符串之一）:
·Error
·hello
·hi
·Mail Delivery System
·Mail Transaction Failed
·Server Report
·Status
·test

正文（以下字符串之一）:
·<空白>
·Mail failed. For further assistance, please contact!
·The message contains Unicode characters and has been sent as a binary attachment.
·It's the long-awaited film version of the Broadway hit. The message sent as a binary attachment.

附件名（以下字符串之一）:
·body
·data
·doc
·document
·file
·message
·readme
·test
·text

附件后缀名（以下字符串之一）:
·BAT
·CMD
·EXE
·PIF
·SCR
·ZIP