This mass-mailing worm propagates by sending copies of itself to all addresses listed in the target user’s Windows Address Book (WAB). It sends an email with this format:
From: [email protected]
Subject:
Message:
Attachment: PP.EXE
It also infects all files with the following extensions:
- EXE
- SCR
- HTM
- HTML
On the 1st day of the month, it overwrites the first 4,660 Bytes of files with these extensions:
- ADC
- R.DB
- DOC
- XLS
This malware runs on Windows 95, 98, ME, NT, 2000 and XP.