However once the program is run it infects the system just the same. The user is unaware of this, and would be led to believe that he or she was directly using notepad.exe. Network scans of port 7597 will detect QAZ infections. If the hacker has client software that can communicate with QAZ, he can then use it to upload more sophicated backdoor software, such as netbus and Back Orifice. These programs can monitor keystokes, see the desktop, run programs on your machine, or modify files.
Users can discover the infection by looking at the size of notepad.exe.
Administrative machines with sensitive fiscal or personnel data are also at risk. All anti-virus products with current definitions can detect this worm. 4.0.7.0 can remove this worm. As of today, the current available DAT definition is DAT 4109 and the current scanning engine is 4.1.2.0. Users may be confused when told that the virus scanner cannot clean notepad.exe.