Early versions of the worm also downloaded a file called Gateway.zip. In addition, the worm downloads DLLs necessary for the email routine. Since these files are legitimate DLLs they are not detected. They can be deleted, if desired. The worm then emails itself to addresses in the Windows address book using the default configured SMTP server.
Later variants attempt to email the author.
The email account has apparently been shutdown. The worm is a backdoor program, which listens on port 1973. New variants also listen on port 19703. These files can be deleted. Remote access includes screen capture, modification to the file system, transferring of files, arbitrary execution, obtaining computer system information, obtaining dial-up networking passwords, and process control.