Network Spreading
To spread over a local network the worm enumarates all network resources (gets all shared directories on remote machines), then copies itself to there. If there is a "\recycled" directory in the victim shared directory the worm copies itself to this directory with the name SirC32.exe : \recycled\SirC32.exeThe worm then appends to the end of AUTOEXEC.BAT file the following command: @win \recycled\SirC32.exeIf there is a "\Windows" directory, the worm renames the RUNDLL32.EXE file to RUN32.EXE , and then overwrites the original RUNDLL32.EXE with its own copy. The worm then sets the hidden attribute to its copies.