Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Sent by email.
The worm spreads over Microsoft Outlook email program and sends itself to all contacts found in the Address Book.
An email sent by the worm looks like this:
Subject: Where are you?
Body: This is my pic in the beach!
If the file JENNIFERLOPEZ_NAKED.JPG.vbs is opened, the worm copies itself in c:\windows. Then, the worm registers twice:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunWORM"="wscript.exe C:\\WINDOWS\\JENNIFERLOPEZ_NAKED.JPG.vbs % HKEY_CURRENT_USER\Software\JENNIFFERLOPEZ_NAKED @="Worm made in algeria" mailed"="1
The worm searches all drives and mapped network drives for files with extension:
*.vbs *.vbe *.js *.jse *.css *.wsh *.sct *.hta *.jpg *.jpeq *.mp3 *.mp2
All these files are overwritten with the virus code.
Finally, the virus "W95/CIH.A" is dropped in "C:\%windDir%\". The file name is "Cih_14.exe".
Description inserted by Crony Walker on Tuesday, June 15, 2004