This file is dropped by the virus in the Windows System folder. It checks the Internet Explorer Download Directory for the file WinFAT32.exe. The virus searches all local drives and network drives for files with certain exstension. If the file is write protected the virus will not succeed in deleting the original files, only to create the companion files with the .vbs exstension. Thus the body of the e-mail is the same as the original variant.
C use a blank message body.
D This variant contains a blank line between each line of virus code. We have attached a detailed invoice to this email. Please print out the attachment and keep it in a safe place. This variant also attack files of types .BAT and .INI in addition to the files targeted by the A variant. The comment lines in the beginning of the code are changed.