Virus Database

Emas.2456

Description Emas.2456

It is not a dangerous memory resident partly encrypted parasitic stealth virus. It hooks INT 22h, returns the control to the host program, waits for termination, then hooks INT 21h and stays memory resident. Then the virus writes itself to the end of COM and EXE files that are executed or opened. Depending on its generation the virus displays the message:
|| 50th Indonesia Emas

The virus also contains the text strings:
(c)05,06-95 Emhaka!** pyuhhall ruwet juga sih....*Rev: OV32.PAS*Com: TP70
>> BL-93115 <<

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Actem

Description I-Worm.Actem

Actem is a worm virus spreading via the Internet as an infected email attachment. The worm itself is a Windows PE EXE file about 61Kb in size, written in Visual Basic.
The infected messages body is empty.
The email Subject is:
"Try this, pretty cool"
There are two files attached to the email. One is a copy of the worm:
ActiveM.exe
While the other is a text file:
list.txt
Actem activates from the infected email only if a user clicks on the attached file. If activated the worm installs itself into the system and displays false messages.
The worm hides itself as an "Active Mouse" application and displays several false messages and menus when the infected file is run.
Actem shows this "active mouse" dialog window:

Other false messages displayed by Actem if executed:




Actem does not install itself to the system and is not active after having run - unless a user clicks on the infected attachment again.
To send out infected messages Actem uses MS Outlook to send messages to all addresses found in the Outlook address book.

I-Worm.Alcaul.h

Description I-Worm.Alcaul.h

This is a virus-worm that spreads via the Internet attached to infected e-mails.
The worm itself is a Windows PE EXE file 5632 bytes in length, and it is written in Visual Basic 6. It is packed by a UPX utility. After unpacking, it is about 16 Kb in length.
Infected messages contain:
Subject: cute worm
Body: the attached file is a compressed picture of a wormall click it..
Attachment: worm.com

The worm activates from infected e-mail only when a user clicks on an attached file. The worm does not install itself to the system and is not activated anymore (except in cases when a user clicks on an attached e-mail again).
To send infected messages, the worm uses MS Outlook and sends messages to all addresses found in Outlook address book.
Installing
While installing, the worm copies itself to disk C: with the name: C:WORM.COM.

Home