W32/Tiotua-G spreads by copying itself to mapped disk drives and removable storage devices.

When run, the worm opens various programs like Notepad, Solitaire, Pinball, Windows Media Player etc. It also tries to open and close the CD drive. It pretends to select and delete all shortcuts on the Desktop. After this it displays a fake message "The 'USB Mass Storage Device' device can now be safely removed from the system." and forces a reboot.

W32/Tiotua-G creates a number of WIndows Schedules Tasks to run itself at various times everyday.


More information can be found at this Sophos page.