A except that the worm writes itself to the disk drive as ttfloader.vbs instead of ttfload.vbs. It tries to determine if a computer is already infected. If the worm finds multiple copies of itself on the computer, it deletes the extra copies. The worm begins to find locations to which it can copy itself. If the worm finds folders where the name matches anything in the following list, it copies itself to that folder using a randomly selected file name.
Spaces are appended to the base file name and the extension .vbs is added.
This is generally the Windows StartUp folder. The worm begins searching for open shares on specific subnets. The worm creates a temporary file with randomly generated IP addresses targeting some subnets more than others. The worm pings each IP address and determines if there is a reply. The worm obtains all the open shares on the computer and maps the network share.