 While running the btdaemon process also inspects whether there is an ".IptabLes" or ".IptabLex" local process, and sends back status for monitoring purposes.  If the "disablerun" command is sent the backdoor will download a file named "run.txt" from one of the following URLs:  The file data is in the format "exe_path_1 | exe_path_2 | ... | exe_path_N".  If none of the paths is correct then a "getsetup.rar" file is downloaded and run.