Email-Worm.Win32.Merond.a spreads as an attachment to infected emails and also via file-sharing networks and removable media. The worm itself is a Windows PE EXE file.

The worm copies its executable file to the Windows system directory:

%System%\javaupd.exe
%System%\javaqs.exe

More information can be found at this Kaspersky page.