It is the first known virus to infect PHP files. PHP is becoming increasingly popular as a server side web site scripting language similar to Perl. Users browsing web sites are not at risk. Infection consists of appending to files a PHP script that will load and execute the virus. Thus infected files do not contain the virus itself, only a reference to it.
Worm is an email worm that appears to have originated in France.
The worm emails itself to addresses in the Windows address book. Once executed, the worm attempts to download additional files, including commercial DLLs that provide emailing routines, and an updated version of the worm. The worm also creates a backdoor that allows remote access to the computer. Restart the computer in Safe Mode, remove registry entries and delete all detected files. The worm spreads via shared network drives.