To be honest, Im not 100% sure. The virus actually "mutated", so to speak, tonight as I was making the removal tool. Same executeable performed different actions tonight than it did lastnight during the tests. If you want to send a copy of aircity.exe to me, I can analyze that for you.
/ 
