It spreads through the e-mail in attachment files. This worm have size about 75KB and written with Visual Basic.
It contains the following lines:
Smile Internet Explorer CD_Open
When the worm is activated it copyes itself to C:\WINDOWS\Start Menu\Programs\StartUp\Smile.exe and in C:\Poems.exe.
It deletes the following files in Windows folder:
and C:\Program Files\Internet Explorer\Iexplore.exe
Then deletes .LNK files in C:\Windows\Desktop.
Deletes Norton Antivirus folders:
C:\Program Files\Symantec Shared
C:\Program Files\Norton AntiVirus\v32scan.dll
C:\Program Files\Norton AntiVirus\Navtask.dll
C:\Program Files\Norton AntiVirus\Navtasks.dll
c:\program files\common files\Symantec Shared\scriptblocking
And copyes itself in their place with their names.
Also this worm deletes the Media Player: C:\Program Files\Windows Media Player\wmplayer.exe
And creates empty folder "Ok" on drive A:.
Use antivirus (also check How To Remove section)Startup Optimizer to remove it from startup.
Still have a problem? Ask for help at our discussion forum.