Virus Database

I-Worm.Anap.a

Description I-Worm.Anap.a

This is a virus-worm that spreads via the Internet. The worm itself is a Windows EXE file about 16Kb in length. It is transferred via the Net in e-mail messages with an infected attachment with the SETUP.EXE name. When such a message is received and the attached EXE file is executed, the worm gets control and starts its spreading routine. This routine scans a Windows temporary file and an Explorer personal folder ("My Documents" as default) for HTML and HTTP files, scans them and searches for e-mail addresses in a file body. When such addresses are located, the worm connects to the network by using SMTP protocol and sends its copy to these e-mail addresses.
The worm sends its copy to up to ten times (addresses) upon each start. It does not install itself into the system and is executed only once - when a user activates the file attached to the infected message. So, compared to other Internet worms known at the moment, this worm is the sample of "nonresident, direct action" Internet Worm.
While generating an infected e-mail, the worm fills the fields. The "from:" field has three parts, each part is randomly selected from the following variants:
Jhon Mark Bill Frank Sam Eva Carla Joan Jean Sophie
M. C. T. R.
Smith Woodruf Brown Steel Driver Seldon Forge Stab McAndrew Gregor

for example, "from: Sam T. Brown". The "mail from:" field is randomly selected from five variants:



The "Subject" field contains just one word: "Patch". The message itself contains the text:
This is the patch you asked for.

To hide its activity, the worm displays a fake error message at the end of its work:
Setup
Integrity check failed due to:
bad data transmision or bad disk access.

On the 5th of any month, the worm also displays the message:
i-worm.Anaphylaxis coded by Bumblebee/29a
.This is an i-worm. Don't worry, this is not a virus. But may occur the
worm has been infected by a virus during its travel and both arrived to
your computer.
The way of the bee

Check other viruses! Be aware! Use Antiviral Software

Basilisk.1639

Description Basilisk.1639

It's a not dangerous memory resident parasitic polymorphic virus. It is a variant of the Eddie viruses. It hooks INT 21h, 27h and writes itself at the end of COM- and EXE-files. On execution of SCAN*.* program it types "Packed file is corrupt" and returns to DOS. It also contains the internal text strings:
Basilisk v1.0
(c) 1992 YAM/RABID International
The slave thinks he is released from bondage
only to find a stronger set of chains

Bastard.1979

Description Bastard.1979

It's a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself at the end of COMMAND.COM and EXE-files that are accessed. The virus does not save complete code in COMMAND.COM and can not replicate from it. It deletes the files the MS*.* and CP*.* files. It contains the internal string "SCCLF-TBVSVIIMMSCV", checks the file name by this string before infection and does not hit the files SC*.*, CL*.*, F-*.* and so on. Depending on the system time and date the virus erases disk sectors and displays the message:
BASTARD!! Virus
CopyRight (c) 1993-94 by Doctor Revenge-Italy-
Please wait,formatting your precious Hard Diskall

The virus also contains the internal text strings:
This virus was written by Doctor Revenge
November 23 - December 29 1993 -Italy-
COMMAND.COM

Home