When the Trojan is executed, it creates the following file:
%UserProfile%\Application Data\[RANDOM CHARACTERS FILE NAME]
The Trojan then locks the computer and displays a fraudulent message purporting to be from law enforcement.
The notice states that the user has been found performing illegal activities and must now pay an on-the-spot fine of 100 Euro to unlock the computer. Payment of the fine is requested through various online payment systems.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":