This description is based on Norman's Sandbox analysis.

foto1.exe : [SANDBOX] contains a security risk - W32/Malware 

[ General information ] 
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**. 
* Creating several executable files on hard-drive. 
* File length: 12800 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\doriot.exe.
* Creates file C:\WINDOWS\SYSTEM\gdqfw.exe.
* Deletes file C:\WINDOWS\_re_file.exe. 

[ Changes to registry ]
* Creates value "wersds.exe"="C:\WINDOWS\SYSTEM\doriot.exe" in key  
    "HKCU\Software\Microsoft\Windows\CurrentVersion\Run". 
* Creates value "wersds.exe"="C:\WINDOWS\SYSTEM\doriot.exe" in key
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Run". 

 [ Process/window information ]
* Will automatically restart after boot (I’ll be back...).
* Enumerates running processes.
* Modifies other process memory.
* Creates a remote thread.
* Enumerates running processes several parses....