此病毒采用LCC编写，一旦运行，将在中毒的机器上建立一个隐藏的代理服务器，并会向其主机发送感染病毒的机器的IP和缓存密码<9x>，病毒能够自动升级。
病毒能通过EMail传播，发送邮件时特征如下：
邮件标题: Re: Your credit application
邮件正文:
Dear sir,
Thank you for your online application for a Citibank
Home Equity Loan.
In order to be approved for any loan application we pull your Credit Profile and Chexsystems information, which didn't satisfy our minimum needs. Consequently,we regret to say that we cannot approve you for Citibank Home Equity Loan at this time.
*Attached are copy of your Credit Profile and Your Application that you submitted with us. Please take a close look at it, you will receive hard copy by mail withing next few days.
此病毒包含三个组件：
一个是DLL文件，用来启动病毒
一个是文件下载器，用来下载病毒并执行
另外一个是病毒主模块
病毒的清除法： 使用光华反病毒软件，彻底删除。 病毒演示： 病毒FAQ： Windows下的PE病毒。
发现日期： 2003-7-21
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
