Creates a copy of itself on the infected computer. The location and name of the dropped file varies. The Trojan also adds a value and data to an autostart registry key such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the Trojan runs automatically each time Windows starts. For example, one particular variant of Win32/IRCbot creates a copy of itself at %windir%\mwoffice.exe and adds value "Windows Update Controller" with data "%windir%\mwoffice.exe" to this autostart registry key.

I don't see this occurring. This is likely due to poor coding of the send message function in the wallet.