Virus Database

I-Worm.Hermes.a

Description I-Worm.Hermes.a

This is email worm spreading by affecting MS Outlook. The worm itself is Win32 executable file about 20K of length (the worm body is compressed, being decompressed it occupies about 60K). The worm is written in Visual Basic language.
The worm connects to MS Outlook by using MAPI functions, gets all addresses from Address Book and sends messages to them. The messages have:
Subject: Re:
Text: [%SenderName%]
where %SenderName% is name of sender (current user email account name).
The attach name is randomly selected from variants:
Seti@home 3.x to 4.0 upd.exe
Seti@home_twk.exe
Seti_patch.exe
Lunetic!.exe
CIH.exe
Energy.exe
ftip.exe
Navidat.exe
Click_ME!.exe
Cenik.exe
Lunetic.scr
fucking.scr
micro$haft.scr
matrix.scr
reboot.scr
Pamela.scr
techno.scr
funny!.scr
Hermes.scr
School_in_da_flame.scr
The worm also displays the message boxes:
_ i-Worm.Hermes _
Code by: gl


This program requires more conventional memory
Unload drivers or memory-resident programs that use conventional memory,
or increase the value for Minimum Conventional Memory in the program's
Memory properities sheet.
The worm also connects the "http://www.seznam.cz" Web site, but does nothing in there.
The worm also tries to write registry keys but fails because of a bug.

Check other viruses! Be aware! Use Antiviral Software

Fellow.1019

Description Fellow.1019

This is a harmless, memory resident infector that hits, in a standard way, .EXE-files that are started. It hooks INT 21h. In September, it displays:
This message is dedicated to
all fellow PC users on Earth
Towards A Better Tomorrow
And A Better Place To Live In

The text "03/03/90 KV KL MAL" present at the end of infected file.

Fewster.1781

Description Fewster.1781

It's a not dangerous not memory resident parasitic virus. It searches for .COM-files and writes itself to their ends. Depending on the system timer it displays one of the messages:
Hahahahahahahahfuckinhahahahahahahah!
You wrote a new virus ? Upload the fucker!
scratches nuts
Anyone who claims his AV software provides 100% detection of
or protection against 100% of viruses is full of shit!
farts anj laxghs
-. .-
_..-'( )`-.._
./'. '||\. (\_/) .//||` .`.
./'.|'.'||||\|.. )o o( ..|//||||`.`|.`.
./'..|'.|| |||||`````` '`"'` ''''''/||||| ||.`|..`.
./'.||'.|||| ||||||||||||. .|||||||||||| ||||.`||.`.
/'|||'.|||||| ||||||||||||( )|||||||||||| ||||||.`|||`'.|||'.||||||| ||||||||||||( )|||||||||||| |||||||.`|||.`
'.||| ||||||||| |/' ``||`` ''||/'' `| ||||||||| |||.`
|/' ./' `./ !| /|!/ ./' `./ `|
V V V )' ` /' `( V V V
` ` ` V ' ' '
rod.bat
You have 37 virus-writing users ? Wow! I run an *AV* BBS, and
TäLöN and Qark and several other Name Brand virus writers call
here regularly. Who have you got ? Deathboy, Nostradamus, and
35 other nobodies! Don't try to impress *me* with your |/|eGa
kö0L K-RäD GRuNcHy World's #1 VX BBS bullshit! I wouldn't swap
*one* of my users for *all* of yours!
jumps on his harlie

The virus contains the internal text string also:
[Rod Fewster's Gonads] Metabolis/VLAD!

Home