Once an infectable system has been accessed, Deloder creates copies of itself in various folders and adds a registry key that will cause the worm to be executed when the system is rebooted. Deloder also drops an IRC trojan into the Windows directory \fonts folder.

Deloder also deletes certain common Windows shares. Ordinarily, these shares are automatically reinstated by the operating system when the machine is rebooted. However, if the system is actively infected by the Deloder worm, rebooting the system will reload the worm and re-delete the shares. Once the worm has been removed properly, a system reboot should restore the previously deleted shares. Though Deloder cannot infect from machines other than Windows NT, 2000, and XP, it can drop copies of itself to other Windows operating system, i.e. Windows 95/98 and ME.

Antivirus software updated March 9, 2003 or later should have no difficulty detecting and removing this worm.