This virus is a companion infector. It infects files by renaming the host file and then copying itself to the system using the host's original file name.

When the virus is first executed, it immediately runs the renamed host file, if it exists. For example, if the virus's file name is iexplore.exe, then iexplore_.exe will be executed.

If the virus file name is not included in the following list, or if the renamed host file no longer exists, then no secondary file will be executed, but the virus will still replicate. It then searches all folders on all hard disks from C to Z, and looks for any of the following file names:

• iexplore.exe
• Mspaint.exe
• Winhelp.exe
• Winhelp.exe
• Winword.exe
• Excel.exe

If the virus finds any of these files, it adds an underscore (_) to the file name (for example, iexplore.exe becomes iexplore_.exe), and it then copies itself to the hard disk using the host's original file name.