I-Worm.CoolNotepad
Description I-Worm.CoolNotepad
This is a VBS Internet worm based on the "LoveLetter" worm. The worm spreads attached to e-mail messages:
Subject:
Cool Notepad Demo
Message body:
Hey check out this text file I sent it will do something neat in notepad.
Enjoy :-)
Attachments name:
COOL_NOTEPAD_DEMO.TXT.vbs
To send infected messages, the worm uses MS Outlook and sends its copies to all addresses listed in the Outlook address book.
The worm also sends its copy to the IRC channel. To do that, it overwrites the SCRIPT.INI file in the mIRC directory with a set of commands that send the worm file to everybody who enters the infected channel. When an infected user enters an IRC channel, the worm also enters a "virus" conference, then sends the message to there:
Cool Notepad Demo
and leaves that conference.
The worm also creates its copy COOL_NOTEPAD_DEMO.TXT.vbs in the Windows system directory and registers it in the system registry in the auto-run section:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun COOL_NOTEPAD_DEMO = FileName
where FileName is the full name of the worm copy in the Windows system directory.
The worm has a side effect. It hides all icons on the Desktop by a Registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer NoDesktop = 1
Check other viruses! Be aware! Use Antiviral Software
Fisher Family
Description Fisher Family
These are not dangerous memory resident parasitic stealth viruses.
Fisher.1100
It hooks INT 21h and infects by the standard way COM-files. It contains the internal text string "COMcom". Sometimes it tries to type the message:
Copyright 1992 by Fisher. Version 3.0 . PUNK-ROCK & BEER FOREVER !
Fisher.2420
This infector hooks INT 17h, 21h and hits COM- and EXE-files. On printing it inserts rude words into the text which is printing. This infector contains the internal text string also:
COMcomEXEexe
(c) Copyright 1991-92 by Fisher. Version 2.0 .
FishN6.a
Description FishN6.a
This is an encoded memory-resident very dangerous virus that hits COM and EXE files by standard way upon their execution and closing. In infected files it increases the year of last modification by 100. The virus supports practically all functions of a stealth-virus. FishN6 encodes its own body not only in files, but also in its TSR copy (on entering the system the virus decodes itself through the INT 21h chain, on exiting - it encodes itself).
Since 1991 FishN6 hangs up the system reporting the following:
FISH VIRUS #6 - EACH DIFF - BONN 2/90
Apart from this string, it contains the following lines:
COD
SHARK
CARP
BASS
TROUT
MUSKYZ
SOLE
PIKE
MACKEREL
FISH
TUNA
FISH FI
The virus hooks INT 13 and INT 21h.
If the number of current day is equal to the number of current month then this virus erases the disk C: sectors. This infector contains the internal text strings:
Don't trouble trouble until trouble troubles you.
(c)Fly
|