Virus Database

Gallery.631

Description Gallery.631

It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus does not manifest itself in any way, it contains the text string:
Art Gallery++

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Kitro.c

Description I-Worm.Kitro.c

Kitro is a family of Internet worms. They spread using infected e-mail messages and Kazaa peer-to-peer network. All versions of the worm obtain e-mail addresses from the .NET Messenger contact list, and send infected messages to these addresses.
Messages sent by these worms may have different subjects, bodies, and attached files. They are sent using direct SMTP access to the "mail.hotmail.com" server.
This version of the worm is similar to I-Worm.Kitro.b. It is a Control Panel applet, its size is either 545792 bytes, or 236032 bytes (compressed). Its installation routine is the same as the one in the I-Worm.Kitro.b.
Replication via the Kazaa network
The worm copies itself in the Kazaa shared directory, or in the root directory of disk C:, if the former doesn't exist.
Replication via e-mail messages
The e-mail replication routine of this worm variant is similar to its previous versions. The worm sends its copies in e-mail attachments to the recipients of the .NET Messenger contact list. The messages that contain the worm may have various subjects and bodies.

I-Worm.Kitro.d

Description I-Worm.Kitro.d

Kitro is a family of Internet worms. They spread using infected e-mail messages and Kazaa peer-to-peer network. All versions of the worm obtain e-mail addresses from the .NET Messenger contact list, and send infected messages to these addresses.
Messages sent by these worms may have different subjects, bodies, and attached files. They are sent using direct SMTP access to the "mail.hotmail.com" server.
This version of the worm is similar to I-Worm.Kitro.b. It is a Control Panel applet, its size is 169984 bytes.
Installation
The worm copies itself to the Windows directory with following names:
PostalDeAmistad.pif
Cristo_Nos_EnseÓa.Doc.pif
Listado.txt.by.Microsoft.com
List.txt.by.Microsoft.com
PostalDeAmistad.pif
Facturas556.XLS.pif
EnLosAndes.pif
YaNoPuedoSerYoMismo.DOC.pif
ReparacionDeMessenger.DOC.pif
TestDeAmoryAmistad.DOC.pif
Once this is done the worm executes one of its copies in the Windows directory. It also randomly selects several of its copies and sets them up to be executed when Windows starts by writing the following autorun keys:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"BNexe" = (one of the file names above)
"Zonavirus" = (path to the worm's copy)
Depending upon internal conditions, the Zonavirus value may be overwritten with the current time value.
The worm also copies itself to the following locations:
c:zonavirus.Dll
C:Bn.exe
Replication via the Kazaa network
The worm copies itself in the Kazaa shared directory or in the C: root directory, if the former doesn't exist.
Kitro also overwrites all files in the Kazaa shared directory with its copies and sets one of the overwritten files up to load when Windows starts by writing the following registry value:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"KAZAAkCuF9" = (Overwritten file's name)
Replication via e-mail messages
The e-mail replication routine of this worm variant is similar to its previous versions. The worm sends its copies in e-mail attachments to the recipients of the .NET Messenger contact list. The messages that contain the worm may have various subjects and bodies.

Home