It searches for a computer in the network where c:\ is shared with full control and accesses files. It will not run on Windows or NT.

Upon execution, it checks for the file "network.log" in the c:\ drive, then writes the text "Log file Open" to this file and writes in this log file random addresses with the text:
" Subnet : <Random number 1>.<Random number 2>.<Random number 3 >.0 "
where:
Random number 1 is the number between 199 to 214
Random number 2 and Random number 3 is the number between1 to 254

Then the it picks a random address to scan then checks for a computer in a network where the shared format of c:\ in full control then maps the c:\ of the infected computer as j:\.

It then adds the following line to the log file "network.log" for every drive it has mapped:
"Copying files to : <remote network drive>" and checks the first network.vbs file it copies and then writes to the log:
"Successful copy to : <remote network drive>" if copy is successful.

After mapping c:\ to j:\, it copies the file network.vbs to the following locations:
J:\windows\startm~1\programs\startup\
J:\windows\
J:\windows\start menu\programs\startup\
J:\win95\start menu\programs\startup\
J:\win95\ startm~1\programs\startup\
J:\win95\

When the infected computer reboots, it runs because it is in the startup directory. the hacker can access all the files in c:\.

This worm can also act as a Distributed Denial of Service (DDOS) attack since the queries the virus performs can overwhelm a server until all requests cannot be serviced anymore, thereby crashing the system.

To Removed
Delete the file "network.vbs" located in directories where it was added. You can also disconnect mapping of the network
drive to ensure complete safety.