This is a non memory-resident encrypted parasitic Windows virus. It infects PE EXE files (Windows32 executable files) by writing virus code to the end of the file and modifying PE file header.
When an infected file is executed, the virus scans Windows KERNEL32 code for file searching, reading/writing and other necessary functions, then searches for EXE and SCR files and infects them. The virus searches for files in three directories: the Windows directory, Windows system directory and current one.
