Troj/Ciadoor-G copies itself to the Windows system folder with the filename scvhost.exe and as a randomly named INI file.
Troj/Ciadoor-G also creates a SYS file in the Windows system folder with the filename wsock32.sys and a ckl009.dat file that contains current updated Trojan run information.
Troj/Ciadoor-G runs in the background waiting to be connected through a preconfigured TCP port by the intruder.