Todnab is a worm that spreads by copying itself to different locations on local hard drives. Once executed, the parasite installs itself to the system and runs a spreading routine. Then it runs a payload. Todnab terminates running antivirus software and security-related applications. It also disables the System Restore service, changes some screen saver and system settings. Furthermore, it opens a lot of non-malicious text files. Todnab runs on every Windows startup. It is also able to run in Windows Safe Mode.