Aside from spreading by mailing itself out to everyone on the Outlook address book, the virus also deletes all files on the victim's computer -- and any mapped, network drives -- by setting the files' lengths to zero.

"For most users, if you are infected with the virus, it means you need to have your machine rebuilt," said Vincent Weafer, director of the Symantec AntiVirus Research Center, referring to rebuilding the computer's files from backup.

[an error occurred while processing this directive] The malicious code is mailed to users as an apparent attachment from a friend, with the subject line "FW:" followed by a random file name. The attached file has that name plus the .VBS extension.

[an error occurred while processing this directive]

e name. The attached file has that name plus the .VBS extension.

For example, the worm might find the file "mydoc.txt" on the user's system and send off a message with the subject line "FW: mydoc.txt" and an attachment of "mydoc.txt.vbs".

The current variant also adds a twist found in other viruses: Polymorphism.

The worm adds a few characters to its script's comment lines, thereby changing the length and "fingerprint" by which most virus software recognizes the code for what it is. That feature could make the virus harder to stop.

Steps to stop it There are three ways to stop the virus, said Weafer.

First, the network administrator can block all e-mail containing VBS scripts.
Second, users of Outlook should download Microsoft's newest patch and turn off VBS scripts.
Finally, users can turn off the Windows Scripting Host in Windows 98 by using the Control Panel/Add-Remove Programs/Windows Settings Tab/Acessories and uncheck the element "Windows Scripting Host."

[an error occurred while processing this directive]