W32/Deborm-R is a network worm which carries and installs Trojans. When run, the worm searches for shares named C or C$ on the local IP subnet that have no password. If a share is found the worm will attempt to copy itself to one of the following folders in the share:
Windows\Start Menu\Programs\Startup
Documents and Settings\All Users\Start Menu\Programs\Startup
Winnt\Profiles\All Users\Start Menu\Programs\Startup
W32/Deborm-R will attempt to install the Trojans Troj/Litmus-203, Troj/Sdbot-Fam and Troj/KillAV-Q.
The worm also adds the following registry entry, containing the name of the worm file so that it is run each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NAV Live Update