The worm emails itself to users listed in the Windows address book, with the subject line "check this out!!!" and an attachment named system32.exe. While typically spread via email, at least one person was infected by downloading what appeared to be a game titled Dope Crop (Weed Farmer). The file was downloaded from a file-sharing application. (See The Gnu Virus Share for info on other file-sharing viral exploits).

When run, the worm creates a copy of itself named SYSTEM32.EXE in the Windows directory and modifies the WIN.INI and registry to load itself on startup.

WIN.INI modifications:

[windows]
load="C:\Winnt\SYSTEM32.exe
open="C:\WINDOWS\SYSTEM32.exe"

[winnt]
load="C:\Winnt\SYSTEM32.exe
open="C:\WINDOWS\SYSTEM32.exe"

Registry modifications:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run\SYSTEM32=C:\Windows\SYSTEM32.exe

To remove the Marijuana worm from your system, delete modifications made to the registry and WIN.INI file, reboot the system, then delete the system32.exe file.

The Marijuana worm, a.k.a. W32/Marijuana and W32/Mari@mm, is not the first virus that attempts to persuade those infected that it means no harm. The VBS/Staple virus apologized to its victims while spreading its infection with a political message detailing the plight of Palestinian children reportedly being killed by Israeli soldiers. Politics aren't the only venue of virus writers. Viral marketing techniques have resulted in viruses such as Homepage, which directed the infected user's browser to various porn sites on the Internet.