The subject of the infected mail will be any of the following;

 USA Missle Strike: Iran War just have started
 USA Just Have Started World War III
 USA Declares War on Iran
 Missle Strike: The USA kills more then 20000 Iranian citizens
 Missle Strike: The USA kills more then 10000 Iranian citizens
 Missle Strike: The USA kills more then 1000 Iranian citizens
 Israel Just Have Started World War III
 Iran Just Have Started World War III

The body of the infected mail will be [blank].

The name of the infected attachment will be any of the following;

 Video.exe
 Read More.exe
 Read Me.exe
 News.exe
 Movie.exe
 More.exe
 Click Me.exe
 Click Here.exe

Upon execution, the Trojan drops a randomly-named file in the folder where it is first executed. It also drops wincom32.sys in Windows System folder.

The Trojan disables the Internet Connection Sharing (ICS) and windows firewall.

It tries to terminate the following processes, which are related to antivirus and other security related software.

 taskmgr.exe
 regedit.exe
 nav.exe
 anti-virus.exe
 navapsvc.exe
 kavpf.exe

The Trojan creates a mutex klllekkdkkd to make sure that only one instance of it is running in the infected computer.

To propogate itself the Trojan collects email address from Windows Address Book and mails itself to these addresses using its own SMTP engine.

This Trojan first appeared on April 09, 2007.