[One] very important detail is that W95.Babylonia is able to modify Wsock32.dll when the file is not loaded in memory. The virus adds a very short hook routine to the "Send" API of Wsock32.dll similar to the Happy99 worm. This short hook routine transfers control to the active part of the virus code when an email is sent. The end result of this code is that the virus adds a MIME-encoded attachment of itself to all outgoing email... increasing its rate of spread. W95.Babylonia is technically a worm, as well as a virus.