This worm spreads via Microsoft Outlook, mIRC, and Pirch
and spreads as a Compiled HTML Help file (THE_FLY.CHM) with embedded Javascript. When executed, the worm will appear with an ActiveX warning. One must approve the warning or the worm cannot propagate.
     The worm will send an email to each email address in your Microsoft Outlook Contact List with the worm attached. It also spreads itself via IRC, if you are using mIRC or Pirch.

The worm will add the registry key:
HKLM\Software\Microsoft\Windows\
CurrentVersion\Run\JavaScript VM
and create the file MSJSVM.JS in the \Windows System directory, SCRIPT.INI in the mIRC directory, and EVENTS.INI in the Pirch program directory. The worm also copies itself to the \Windows directory as THE_FLY.CHM and to the \Windows System directory as DXGFXB3D.DLL.

When executing the worm, one will be prompted with an ActiveX warning:
If this ActiveX warning is not approved, one will be prompted with a window to approve the warning:
Only when the ActiveX warning is approved can the worm propagate.
If Microsoft Outlook is installed, the worm will iterate through all e-mail addresses in your Contact Lists. A new e-mail message is then sent to these addresses.
The Subject of the message is set to:
Funny thing
and the body is:
If you ride a motorcycle, close your mouth :)

     The next time Microsoft Windows is started, the JavaScript file MSJSVM.JS is executed. The worm searches through your computer for installations of mIRC or Pirch. If discovered, the worm creates the file SCRIPT.INI or EVENTS.INI, respectively. These files cause one to unknowingly transfer the worm to any IRC users who join the channel(s) on which you reside when using IRC.

The detected files, THE_FLY.CHM, MSJSVM.JS, and DXGFXB3D.DLL should be deleted. The files SCRIPT.INI and EVENTS.INI should be deleted and replaced with known clean backups if necessary.
The registry key:
HKLM\Software\Microsoft\Windows\
CurrentVersion\Run\JavaScript VM
should be removed.