Virus Database

I-Worm.Galil

Description I-Worm.Galil
Galil is a worm virus spreading via the Internet as an attachment to infected emails. The worm consists of several components, all of which are Windows PE EXE files written in Visual Basic.
Worm components:

Main file: "iLLeGaL.exe", size approx. 81KB
Spreading component: "Mplayer.exe", size approx. 14KB when compressed by UPX, the decompressed size is 37KB
SMTP control: "SMTP.ocx", size approx. 26K when compressed by UPX, the decompressed size is 90KB
Installing
When the main worm file is run it installs itself and its other components into the system. While installing the worm copies its main file to the Windows system directory under the name "iLLegGaL.exe". The other worm components are installed into the same directory. The "Mplayer.exe" component is then registered in the system registry auto-run key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices
iLLeGaL = %SystemDir%Mplayer.exe
The worm then displays a fake Flash animation and the message:
Sorry !
Looooooooool , thanx fo da time u spent thinkin ov me
Spreading
The worm reads emails from victim computer MS Outlook address books and searches for email addresses in .HTM and .HTML files. To send infected messages the worm uses a direct connection to SMTP servers.
Infected email attributes include:
Subject: Fwd: Crazy illegal sex !

The message body text is randomly selected from a file on the C: drive or is in HTML format and contains text such as below:
Note: forwarded message attached.
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
Forwarded Message [ Save to my Yahoo! Briefcase | Download File ]
From: Sara1987@yahoo.com
To: Virgin_gurlz_N_boyz@yahoogroups.com
Date: 24 Aug 2002 17:11:18 -0000
Subject: Fwd: Crazy illegal Sex

Hii
Is it really illegal in da USA?
who knows :P
If u have a weak heart i warn u
DON'T see dis Clip.

e.t.c.
Attachments:
iLLeGal.exe or illegalSex.zip
The worm activates from infected emails only when a user clicks on the attached file. If the attachment file is clicked the worm installs itself to the system and runs its spreading routine and payload.
Payload
The 'Galil' worm creates a new key (counter) in the system registry:
HKLMiLLeGal
This counter is increased (advanced) each time the worm is run. When the counter reaches '5' the worm deletes all files on the D: E: F: and G: drives and then displays the message:
ZaCker
No Peace Without war,i hate war but im forced to love it,Hidden Power's gonna b there wherever u r

Check other viruses! Be aware! Use Antiviral Software

Konkoor.1933

Description Konkoor.1933

This is a dangerous memory resident parasitic virus. While executing an infected program, this virus searches for the DOS address in the INT 21h handler, then searches for COM files, and hits them. Then the virus hooks INT 21h, and intercepts the FindFirst function (AH=4Eh). During calls to that function, the virus searches and infects COM files and also upon the execution of an infected program. While infecting, the virus writes itself to the beginning of the files, and encrypts the host file. On the 100th infection, or depending on the system date, it erases CMOS and hard drive sectors, and displays the following messages:
Warning !!! KONKOOR Must be destroyed !
Sig: -= The Real Computer Scientists =-
and
KONKOOR V1.60 -- Date: 10 MARCH 1994
While installing, it also displays the message:
Bad command or file name

Konkoor.3072

Description Konkoor.3072

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, intercepts the DOS function ChangeDir (AH=3Bh), and when that function is executed, the virus searches for EXE-files, and writes itself to the middle of the file. The virus has a memory allocation error, and may halt the system while infecting the files. The virus checks the file names for the text string, and does not infect these files:
SCAN
CLEAN
VSHIELD
FINDVIRU
FV386
FV86
CLEANBOO
VIVERIFY
CERT
MSAV
GUARD
TDUMP
Under DOS 4.x or earlier, the virus displays the following message, and returns to DOS:
Incorrect DOS version
On the 13th of any month, the virus overwrites the hard-drive MBR with a trigger program. While booting from this MBR, the program displays the following message:
Konkoor v2.0 - Crack Master - Last Days Of 1995
What Was The First Iranian Virus ?
1. Abbas ??? (Was it Iranian ?)
2. Roohi
3. TDD - Konkoor v1.0
4. None Of Above
-= This is The Last One If You Solve Copyright Problem =-
Choose the correct answerall
waits for key '3', and continues booting.

Home