According to Symantec's write up "it also infects .exe and .scr files in folders containing [RANDOM CHARACTERS].t".
What if one of the .exe/.src files is run on the same computer - then all the same files would be infected again and eventually would all be corrupted, or is there a check against this?
If one of those infected files were manually transferred to a new computer and run, that computer will now be compromised?
Regarding the fact "the worm ends security-related processes, if one of the following words is included in the window title: [lengthy list follows]" how does an AV defend against this? (3a) How is removal possible if each time a program starts it's knocked out?
