This worm would spread over IRC, however this routine has long since stopped working since the worm originally downloaded this file from a server that has been deleted. This would just be the end result of an infection prior to the worm spamming itself to every IRC channel it could find.
When the user runs the program, usually when they receive the file through IRC, it will pop up many errors, including:
- svchost.exe crashing claiming memory could not be written with the instructions deriving from thread 0x71a64618
- Changes the user's login name to COCK_SUCKING_FAGGOT
- A Windows Protection Error, indicating that multiple critical files have been overwritten
- Finally, an error in memory block #A5487F (This message is a fake error put out by the worm.)
These errors are all caused by the fact that critical processes have been overwritten with irrelevant data. If the user now checks the file attributes, they will discover that the file sizes have decreased drastically. If the user tries to run programs, the worm will hide the file and not allow the user to run said application.
Upon restarting, files that is compromised included the startup ones, and the computer will fail to boot.
On Windows 9x, it will still boot, but prompt the user to reinstall Windows. However, reinstalling simply results in multiple errors, and the user will not be able to start, as setup causes multiple Blue Screens. This will require the user to format and reinstall if this occurs.