This worm spreads via the Internet using a vulnerability in the Microsoft Windows LSASS service.
The vulnerability is described in Microsoft Security Bulletin MS04-011, which can be found at:
When launching, the worm registers itself in the system registry autorun key:
avserve2.exe = %WINDIR%\avserve2.exe
The worm scans IP addresses, searching for computers which have the vulnerability described in MS04-011.
A vulnerable computer will launch the command packet "cmd.exe" on TCP port 9996, and will then accept commands to download and launch copies of the worm.
Downloading is carried out via FTP protocol.
In order to do this the worm launches an FTP server on TCP port 5554 and on request from the victim computer loads a copy of itself.
The copy of the worm will be loaded under the name "_up.exe", where "_" is a random number.
To remove this worm you can download free utility from www.kaspersky.com