This Internet virus-worm spreads via E-mail by sending infected messages from infected computers. While spreading, the worm uses MS Outlook and sends itself to adresses that are stored in the MS Outlook Address Book.
The worm is written in the scripting language “Visual Basic Script” (VBS). It operates only on computers on which the Windows Scripting Host (WSH) is installed. In Windwos 98 and Windows 2000, WHS is installed by default. To
The worm arrives to a computer as an e-mail message with an attached VBS file, which is the worm itself. The message in the original worm version reads as follows:
Upon activation by a user (by double clicking on the attached file), the worm opens MS Outlook, gains access to the Address Book, obtains the first 50 addresses from each address list and sends messages with its attached copy to all of them. The message subject, body and attached file name are the same as above.
The original worm version does not have any payload.