When executed, the trojan places a fake "Start" button covering the real Start button, making it hard to detect.
This trojan works on all Windows systems, however the label of the fake "Start" button is always in English, and is styled to be like the Windows Standard palette on Windows ME or below. If the host system's language is not English (like that in the image), has a different color palette, or is running Windows XP or higher, it can be noticed immediately.
When the fake "Start" button has been clicked, the trojan kills the process of Explorer.exe, turns the screen black, and disables the Ctrl+Alt+Del input, followed by hanging the system. The user must take a cold reset in order to use the computer again. However the trojan has no other harmful payload, and it can be easily removed.
When the trojan is triggered under NT based system (like Windows NT 4.0 or 2000), it would turn the screen to black only, and the user may still able to kill the trojan's process in Task Manager after triggering.
Pressing the Windows key on the keyboard will not trigger the payload, and open the real Start Menu.