“Symptoms:
Presence of registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun or RunOnce
with a value formed with the folowing words:
sys,host,dir,explorer,win,run,log,32,disc,crypt,data,diag,spool,service,smss32
pointing to a file in Windows Directory whose name is formed with the above words too, and the presence of that file.
Technical description:
The worm comes by mail in the following form, in German or English language:
Subject:
Microsoft Alert: Please Read!
or
Microsoft Alarm: Bitte Lesen!”
