Virus Database

I-Worm.BadAss

Description I-Worm.BadAss

This is a virus-worm that spreads via the Internet using MS Outlook. The worm itself is a Windows EXE file about 25Kb in length, and written in VisualBasic. The worm seems to be based on the "Melissa" macro-virus worm - the functions and sequence of instructions in the worm code are very similar to the "Melissa" source code. It seems that this worm was compiled from a slightly modified "Melissa" source.
The worm is transferred via the net in e-mail messages with an infected attachment. The original attachment has the BADASS.EXE name, but it is possible to rename the EXE file manually, and it then will spread with a new name.
When an infected message is received and the attached EXE file is executed, the worm gains control and starts its main routine. This routine displays message boxes, then run the infection routine that opens the Outlook database, obtains e-mail addresses from the Address Book and sends infected messages to the addresses found. The subject in the infected messages contains the text "Moguh.." and the message text is "Dit is wel grappig! :-)".

The first message box displayed by the worm appears as follows:
Kernel32
An error has occured probably because your c**t smells
bad. Is this really so?
[ Yes ] [ No ]

Upon the mouse cursor moving to the [No] button, the worm moves this button another place to the left [Yes], and return it back when the mouse cursor moves near to button, and so on until clicking [Yes]:
[ Yes ] [ No ]
[ No ] [ Yes ]
[ Yes ] [ No ]

So the worm does not allow one to click the [No] button. When the [Yes] button is pressed, the worm displays another message and runs its infection routine:
WIN32
Contact your local supermarket for toiletpaper and soap to
solve this problem.
[ OK ]

Check other viruses! Be aware! Use Antiviral Software

Alphabet.447

Description Alphabet.447

This is a harmless, non-memory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus does not manifest itself in any way. It contains the following text string:
[Alphabetic.A](c) Alpha 1994

AlphaVirus family

Description AlphaVirus family

These are dangerous memory resident encrypted parasitic viruses. They hook INT 21h, and write themselves to the end of EXE files that are executed. They were named after text strings in their codes:
"AlphaVirus.1121": AlphaVirus [07]
"AlphaVirus.1555": AV[07]

AlphaVirus.1121
This virus does not infect the anti-virus programs ADINF, AIDSTEST, and DRWEB. To avoid detection and disinfection by these anti-viruses, the virus deletes the DRWEB.INI file, displays a message in Russian and halts the computer when ADINF is executed. On the 31st, the virus overwrites PAS files with a text in Russian.
AlphaVirus.1555
This virus also hooks INT 28h (DOS idle) and, upon such call at 10:59:59, depending on random data, stuffs one of the following commands to the keyboard buffer:
deltree C: /Y
arj m temp *.*
format c:
defrag c: /F

The virus does not infect the programs: AVP, RAR, DN, WEB, WIN, DRWEB, AIDSTEST, and ADINF. When anti-viruses AVP, WEB, WIN, and DRWEB are executed, the virus removes itself from the system memory (then the virus installs into the memory again, then any infected program is executed).
Upon opening any .PAS file, the virus overwrites it with a text in Russian.

Home