1. Il se copie sous :
    
   • %Windir%\java.exe
   • %Windir%\services.exe
      
2. Ajoute les valeurs :
   
   "Services" = "%Windir%\services.exe"
   "JavaVM" = "%Windir%\java.exe"
   
   au registre :
   
   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    
3. Installe une backdoor (zincite) sur le port 1034/TCP et crée les fichiers suivants (pour l'enregistrement des logs) :
    
   • %Temp%\zincite.log
   • %Temp%\[Nom_aléatoire].log
      
4. Collecte les emails présents sur les fichiers :
    
   • .doc
   • .txt
   • .htm
   • .html
      
5. Essaye de collecter de nouvelles adresses emails via les moteurs suivants :
   • search.lycos.com
   • search.
   • www.altavista.com
   • 
      
6. L'email a les caractéristiques suivantes :
   
   De :
   
   Sujet:
    
   • say helo to my litl friend
   • click me baby, one more time
   • hello
   • error
   • status
   • test
   • report
   • delivery failed
   • Message could not be delivered
   • Mail System Error - Returned Mail
   • Delivery reports about your e-mail
   • Returned mail: see transcript for details
   • Returned mail: Data format error
     
     Message : Variable
   
    
   • Dear user {|of },{ {{M|m}ail {system|server} administrator|administration} of would like to {inform you{ that{:|,}|}|let you know {that|the following}{.|:|,}}|||||}
     {We have {detected|found|received reports} that y|Y}our {e{-|}mail |}account {has been|was} used to send a {large|huge} amount of {{unsolicited{ commercial|}|junk} e{-|}mail|spam}{ messages|} during {this|the {last|recent}} week.
     {We suspect that|Probably,|Most likely|Obviously,} your computer {had been|was} {compromised|infected{ by a recent v{iru}s|}} and now {run|contain}s a {trojan{ed|}|hidden} proxy server.
     {Please|We recommend {that you|you to}} follow {our |the |}instruction{s|} {in the {attachment|attached {text |}file} |}in order to keep your computer safe.
     {{Virtually|Sincerely} yours|Best {wishe|regard}s|Have a nice day},
     { {user |technical |}support team.|The {support |}team.}
     
      
   • {The|This|Your} message was{ undeliverable| not delivered} due to the following reason{(s)|}:
     Your message {was not|could not be} delivered because the destination {computer|server} was
     {not |un}reachable within the allowed queue period. The amount of time
     a message is queued before it is returned depends on local configura-
     tion parameters.
     Most likely there is a network problem that prevented delivery, but
     it is also possible that the computer is turned off, or does not
     have a mail system running right now.
     
      
   • Your message {was not|could not be} delivered within days:
     {{{Mail s|S}erver}|Host} } is not responding.
     The following recipients {did|could} not receive this message:
     >
     Please reply to postmaster@{|}
     if you feel this message to be in error.
     The original message was received at [current time]{
     | }from { ]|{]|]}}
     ----- The following addresses had permanent fatal errors -----
     {>|}
     {----- Transcript of {the ||}session follows -----
     ... while talking to {host |{mail |}server ||||}{.|]}:
     {>>> MAIL F{rom|ROM}:[From address of mail]
     >... {Mail quota exceeded|Message is too
     large}
     554 >... Service unavailable|550 5.1.2 >... Host unknown (Name server: host not found)|554 {5.0.0 |}Service unavailable; ] blocked using {relays.osirusoft.com|bl.spamcop.net}{, reason: Blocked|}
     Session aborted{, reason: lost connection|}|>>> RCPT To:>
     >... {User unknown|Invalid recipient|Not known here}}|>>> DATA
     { |}{ |}{ |}
     Fichier joint :
   
   
    
7. readme
8. instruction
9. transcript
10. mail
11. letter
12. file
13. text
14. attachment
15. document
16. message
    
    Avec une extension:
17. cmd
18. bat
19. com
20. exe
21. pif
22. scr
23. zip
    
    Le ver evite de se propager vers des emails contenant les chaînes :
24. mailer-d
25. spam
26. abuse
27. master
28. sample
29. accou
30. privacycertific
31. bugs
32. listserv
33. submit
34. ntivi
35. support
36. admin
37. page
38. the.bat
39. gold-certs
40. feste
41. not
42. help
43. foo
44. soft
45. site
46. rating
47. you
48. your
49. someone
50. anyone
51. nothing
52. nobody
53. noone
54. info
55. winrar
56. winzip
57. rarsoft
58. sf.net
59. sourceforge
60. ripe.
61. arin.
62. google
63. gnu.
64. gmail
65. seclist
66. secur
67. bar.
68. foo.com
69. trend
70. update
71. uslis
72. domain
73. example
74. sophos
75. yahoo
76. spersk
77. panda
78. hotmail
79. msn.
80. msdn.
81. microsoft
82. sarc.
83. syma
84. avp

 »