Asunto (cualquiera de los siguientes):

1. Find you perfect match, whether you are married or not...
2. Check your IQ... IQ Calculator attached...
3. New Microsoft Messesnger, Advanced Version of MSN Messenger attached.
4. See the Family Photo, Bill Clinton on a donkey

Archivo adjunto: Family.exe o Family1.exe (104 Kb)

Cuando ejecutamos el archivo adjunto (doble clic sobre él), el virus crea una copia de si mismo en estas ubicaciones ("C:\Windows" puede ser diferente si Windows está instalado en un directorio diferente al que utiliza por defecto):

C:\Windows\System\Win32dll.exe
C:\Windows\Family.exe

También agrega las siguientes entradas al registro de Windows:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Resource Manager=C:\Windows\System\Win32dll.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Resource Manager=C:\Windows\System\Win32dll.exe

Texto (uno de los siguientes textos):

1. How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway check the family photo which i have send as attachment. It's real funny. 
   Hey, i will write a detailed letter later... Now i am little busy. Do not forget to send your opinions about the family photo to me.
2. How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway find your perfect match for your life. It is in the file attached. It doesn't matter if you are married or not. It's worth having a look. It's real funny. 
   Hey, i will write a detailed letter later... Now i am little busy. Do not forget to send your opinions about the Perfect Match to me.
3. How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway check the new New released Microsoft Messenger. It is in the file attached. It doesn't matter if you are using another messenger right now. It's worth having a look. Please include me in your contact list. I am in ahuryy now. I am sure you will excuse me for now. We can chat later through the new messenger. It has advanced options like voice chat, multiple telephonic conversations etc. 
   with lots of love 
   Hey, i will write a detailed letter later... Now i am little busy. Do not forget to include me in Microsoft Messenger. I am sending you this file as attachment so that you can avoid downloading it from Microsoft's slow Server. Bye for now...
4. How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway Calculate your IQ now. It is program which helps you determine your IQ.It is in the file attached. It doesn't matter if you are child or grown-up. It's worth having a look. It's really helpful to know your potential and your problems. 
   Hey, i will write a detailed letter later... Now i am little busy. Do not forget to send your opinions about the IQ Calculator to me.
5. How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway check this funny game which i have send as attachment. It's real funny. 
   Mail me back for any more files. I am sure you will ask me. I have a lot of funny files like these.
   Nothing more for the time being,
   with luv
   Hey, i will write a detailed letter later... Now i am little busy. Do not forget to send your opinions about the game to me.

Es importante hacer notar que el virus posee la habilidad de usar un párrafo de uno de los mensajes, con el segundo párrafo de un segundo mensaje. Por ejemplo:

How are you ? I am Fine. I don't know why you did not mail me back for my mails. Anyway Calculate your IQ now. It is program which helps you determine your IQ.It is in the file attached. It doesn't matter if you are child or grown-up. It's worth having a look. It's really helpful to know your potential and your problems. 
Mail me back for any more files. I am sure you will ask me. I have a lot of funny files like these.
Nothing more for the time being,
with luv
Hey, i will write a detailed letter later... Now i am little busy. Do not forget to send your opinions about the IQ Calculator to me.

Dependiendo del entorno actual del sistema, el gusano puede hacer que el siguiente texto aparezca en la barra de títulos de cualquier programa que usted ejecute:

FAYSAN CORPORATION, INTELLEGENT PROGRAMMER

Luego de ello, el programa es cerrado, sin llegar a ejecutarse, causando el mal funcionamiento de Windows.

Como sacar el virus de un sistema infectado

1. Pinche en Inicio, Ejecutar, y teclee REGEDIT (más ENTER).

2. En el panel izquierdo del editor de registro de Windows, pinche en el signo "+" hasta abrir la siguiente rama:

HKEY_LOCAL_MACHINES
software
Microsoft
Windows
CurrentVersion
Run

3. Pinche sobre la carpeta "Run". En el panel de la derecha debería ver algo como:

"Windows Resource Manager" "C:\Windows\System\Win32dll.exe"

4. Pinche sobre el nombre "Windows Resource Manager" y pulse la tecla SUPR o DEL. Conteste afirmativamente la pregunta de si desea borrar la clave.

5. En el panel izquierdo del editor de registro de Windows, pinche en el signo "+" hasta abrir la siguiente rama:

HKEY_LOCAL_MACHINES
software
Microsoft
Windows
CurrentVersion
RunOnce

6. Pinche sobre la carpeta "RunOnce". En el panel de la derecha debería ver algo como:

"Windows Resource Manager" "C:\Windows\System\Win32dll.exe"

7. Pinche sobre el nombre "Windows Resource Manager" y pulse la tecla SUPR o DEL. Conteste afirmativamente la pregunta de si desea borrar la clave.

8. Use "Registro", "Salir" para salir del editor y confirmar los cambios.

9. Reinicie su computadora (Inicio, Apagar el sistema, Reiniciar).

10. Pinche en Inicio, Buscar, Archivos o carpetas.

11. Asegúrese de tener en "Buscar en:" la unidad C:\ y marcado "Incluir subcarpetas".

12. En la casilla "Nombre" escriba (o "corte y pegue") los siguientes nombres:

Family.exe, Family1.exe, Win32dll.exe

13. Pinche en "Buscar ahora".

14. Si aparece alguno (o todos) de estos archivos, márquelo.

15. Pulse la tecla SUPR o DEL, y pinche en SI para confirmar el borrado. Repita esto con cada archivo encontrado.

16. Vaya a la papelera de reciclaje en el escritorio, pinche con el botón derecho sobre ella y seleccione "Vaciar la papelera de reciclaje".

17. Ejecute uno (o más) antivirus actualizados para revisar y limpiar su sistema.

Fuente: Symantec