This worm has been designed to spread by e-mail mainly. In order to spread to other computers it can use Microsoft Outlook, Outlook Express or MAPI.
In the case of Microsoft Outlook, the characteristics of the message will be the following:
Subject: Outlook Express Update
Message Body: MSNSoftware Co.
In the case of Microsoft Outlook Express, the worm modifies the properties of the message in such a way that all the outbound messages will have HTML format from that point. In this way, the virus code will be embedded in the HTML body. To carry out this action the virus modifies the following entry in the Windows registry:
When it comes to propagation through MAPI, it will not be necessary for affected computers to have an e-mail client installed. In this case, two types of messages will be sent. The first of them is similar to the one sent through Microsoft Outlook, but on this occasion the recipients will be obtained from the Windows Address Book.
The recipients of the second type of message that can be sent will be obtained from Microsoft Outlook's Address Book. In this case the message will have the following characteristics:
Subject: recipient's address
Message Body: Microsoft Outlokk 98