Todnab.b is a worm that spreads through network shares and mapped network drives. Once executed, the parasite installs itself to the system and runs a spreading routine. Then it runs a payload. Todnab.b disables the System Restore service and system settings. The worm runs on every Windows startup.