Virus Database

I-Worm.Anset.a

Description I-Worm.Anset.a

This is the worm virus spreading via the Internet being attached to infected emails. The worm itself is a Windows PE EXE file about 462Kb of length (or about 186Kb in UPX packed form), written in Delphi.
The message has followed fields:
Subject: ANTS Version 3.0
Message body:
Hi, Anhängend die neue Version 3.0 von ANTS, dem bislang einzigartigen kostenlosen Trojanerscanner. Zum installieren einfach die angefügte Datei ausführen. Attached you will find the brand new Version 3.0 of ANTS, the unique freeware trojan scanner. To install ANTS simply run the attached setup file.
Adieu, Andreas
webmaster@avnetwork.de
http://www.ants-online.de
Attached filename: ants3set.exe
The e-mail and Web-site mentioned in the message are fake and the author of the ANTS anti-Trojan scanner (Andreas Haak) is not responsible for this mass mailing

The worm activates from infected email only in case a user clicks on attached file. The worm then installs itself to the system and runs spreading routine.
While installing the worm copies itself to Windows directory with random generated name, for example:
zfcy.exe
BM.exe
GG.exe
hlutl.exe
and registers this file in system registry auto-run key:
HKCUSoftwareMicrosoftWindowsCurrentVersionRunonce ""="C:Windows.exe"
To proliferate the worm obtains victim email addresses from MS Outlook address book, then looks for following files on C: drive:
*.php *.htm *.shtm *.cgi *.pl
and extracts more email addresses from there, if there are any. Then the worm copies its EXE file with C:ANTS3SET.EXE name, attaches it email message and sends to victim addresses by using direct connection to SMTP server.
The worm has some mistakes in its spreading routine and in some cases it cannot spread.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Antisocial

Description Macro.Word97.Antisocial

Dangerous "Melissa" -like macro virus. It infects documents and global macros area (Normal template) on document closing. This virus also spreads via email in the same way as "Melissa" does: On first infected document opening on a computer the virus attempts to send itself to the first sixty entries from the Outlook address book. The virus' message has infected document in attachment and:
Subject line: Important Message From
Text: Look what I foundall

After first attempt to send itself via email the virus sets registry key value:
HKEY_CURRENT_USERSoftwareMicrosoftOfficeSixtieth Skeptic = "Where's Jamie?"

Next time the virus checks this key to prevent duplicate sending.
In additional the virus drops its code into file "C:SS.BAS" and creates Visual Basic Script in file "C:SS.VBS" that reinfects the Normal template on each system reboot.

Macro.Word97.AntiWazzu

Description Macro.Word97.AntiWazzu

This macro virus contains two macros: autoopen and tempcdg. It spreads on documents opening. While infecting it also deletes "autoClose" macro, in this way it struggles against "Wazzu" virus family. Starting from April 1st 1999 the virus activates self-destruction routine. This routine deletes "autoopen" macro that contain the main virus code.

Home