Once executed, the worm copies itself as:%Windir%\svchost.exe The worm creates the following registry entry so that it is executed every time Windows starts:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"svchost" = "%Windir%\svchost.exe" The worm then creates the following registry subkey and value:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\System7154\"GL" = "[DATE]" The worm opens a back door on the compromised computer on TCP port 7154. The worm displays a dialog box with one of the following texts: "No me olvido de ti" screen.zip * %Windir% * %ProgramFiles%