A worm that usually comes as an ICQ_GREETINGS.EXE program attachment in email. The size of this attached program file is 27,648 bytes.
     The worm appears to be a straight Visual Basic porting of W97M.Melissa payload routine. In fact, it is so similar that it marks its activation in the Windows Registry, also. The marker is the value "... by diejkdls"
     Every time it is executed, the worm attempts to perform malicious activities:
format d: /autotest /q /u
format e: /autotest /q /u
format a: /autotest /q /u
format f: /autotest /q /u
format u: /autotest /q /u
format b: /autotest /q /u
deleting files c:\*.c*, d:\*.c*,
c:\WinNt\System\*.c*, c:\WinNt4\System\*.c*,
c:\Windows\System\*.c*, c:\WinNt\System\*.o*,
c:\WinNt4\System\*.o*, c:\Windows\System\*.o*,
c:\WinNt\*.i*, c:\WinNt4\*.i*, c:\Windows\*.i*

The worm registers itself in Windows Registry to start every time Windows begins. The registry key is in:
HKLocalMachine\Software\Microsoft\Windows\
CurrentVersion\Run
as the value "ICQ99b" to run C:\ICQ.EXE
     The worm adds two Windows Registry keys.
First of two Registry keys added:
HKLocalMachine\Software\Microsoft\WindowsNT\
CurrentVersion\Windows\Run\ICQ99b
with the same value set to C:\ICQ.EXE

Second of two Registry keys added will add a particular user information in the virus to the following registry:
HKLocalMachine\Software\Microsoft\WindowsNT\
CurrentVersion\Windows\CurrentVersion\
There are also strings of MyPics and Passion.exe inside the worm program.

As with other worms or trojan horse programs, the detected file must be deleted.
There is no need to remove the marker from the Windows Registry. In fact, its presence deactivates the worm routine.