The worm author had access to an undocumented function of one of the Microsoft Windows operating system, so he was able to break into the "lsass" process and identified itself with this system process. "The virus is the more treacherous as it cannot be blocked until the process "lsass" is stopped, or the process' stopping could mean also damaging the operating system", stated Mihai Chiriac, Virus Researcher at BitDefender.
The worm comes by e-mail, without exploiting the famous I-Frame vulnerability, but bringing to table a series of well-defined, social engineering structures. "It's all about sex, cracked software or human curiosity" says Mihai Chiriac. "Today's software philosophy very much requires people's trust and confidence. When patching, "pack-installing" and testing becomes a rule, no one should wonder why clicking on such attachments is so frequent", Mihai added.