Symptoms

Removal instructions:

Analyzed By

Technical Description:

         This malware does the following actions when executed:
              * launches "explorer.exe" with the system drive as parameter (which indirectly executes , if present, autorun.inf)
              * copies itself into %windir% with the name  "xcopy.exe"
              * copies %windrive%\host.exe into %windir%\svchost.exe
              * copies %windrive%\autorun.inf into %windir%\autorun.inf
              * launches %windir%\svchost.exe