NOTE
A quick check for infection is to look for a process name starting with `NETW_'. This may be done with a SHOW PROCESS command.
3. The program then changes the default DECNET account password to a random string of at least 12 characters.
4. Information on the password used to access the system is mailed to the user GEMTOP on SPAN node 6.59. Some versions may have a different address.11
5. The process changes its name to `NETW_' followed by a random number.
6. It then checks to see if it has SYSNAM priv. If so, it defines the system announcement message to be the banner in the program:
Worms Against Nuclear Killers!
Your System Has Been Officically Wanked.
You talk of times of peace for all, and then prepare for war.
7. If it has SYSPRV, it disables mail to the SYSTEM account.