When W32.Spybot.Worm is executed, it does the following:
Copies itself to the %System% folder. Some variants may have one of the following file names:
Bling.exe
Netwmon.exe
Wuamgrd.exe
Note: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).