A self-emailing worm that spreads via email clients that use Microsoft Outlook. The email messages is disguised as an email from someone you know and contains the attachment video.exe. This Trojan accesses all recipients found in the Outlook Address list and sends itself out as attachment to each, clogging email servers.
This email has no subject line, and contains the following message body:
"Here's a digital video for you"

Once the video.exe file is executed, the worm copies itself to the root directory of drive C:\ under the name: "Zip01.exe" and changes the registry values in the Windows registry so that the Trojan is automatically executed each time the computer is booted.

The Trojan adds the following to the registry value On Windows 95 or 98:
HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\
Currentversion\Run\Agent5 = c:\zip01.exe

On Windows NT:
HKEY_LOCAL_MACHINES\Software\Microsoft\Windows NT\CurrentVersion\WindowsNT\Run\ Agent5 =c:\zip01.exe

The Trojan then disables the ctrl-alt-del and alt-tab keys so that the user cannot see it in the task manager (Windows 9x only) when running in memory. The Trojan also deletes all *.INI files in the C:\WINDOWS directory randomly, which results in a failure to start Windows. Once installed, the worm periodically checks the Microsoft Outlook address book and emails itself to entries listed.

If the virus is executed after the 16th of any month, the worm checks for certain conditions on the PC. If these conditions are met, the worm delete "*.c*" and "*.o*" from the following sub directories:
c:\WinNt\System\
c:\WinNt4\System\
c:\Windows\System\
and files "*.i*" from:
c:\WinNt\
c:\WinNt4\
c:\Windows\

Once these files have been detected, they should be deleted immediately.