W32/Sober.A@mm

Error
(!) File not complete!
[OK]

The virus will write a copy of itself into the undefinedWindowsundefined\System32 folder as several possible file names, and then modify the registry to load at Windows startup as in this example -

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run\
system = C:\WINNT\System32\systemchk.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
system = C:\WINNT\System32\systemchk.exe

The virus will then scavenge the hard drive looking for email addresses - the virus looks inside files with the following extensions -

.htt , .rtf, .doc, .xls, .ini, .mdb, .txt, .htm, .html, .wab, .pst, .fdb, .cfg, .ldb, .eml, .abc, .ldif, .nab, .adp, .mdw, .mda, .mde, .ade, .sln, .dsw, .dsp, .vap, .php, .asp, .shtml, .shtm, .dbx, .hlp, .mht, .nfo

The virus will create the path undefinedWindowsundefined\System32\Macromed\Help and then write a file "media.dll" to that folder - media.dll will contain all of the email addresses found on the system

The virus will then use SMTP code to send randomly formatted email messages to recipients in the list from media.dll - the subject lines and body text will be varied, and the attachment file name will also be chosen at random from a list