Virus Database

I-Worm.Homepage

Description I-Worm.Homepage

This is an Internet worm that widely spread on 9 May 2001. The worm is written in Visual Basic Script language (VBS) and spreads as a "homepage.HTML.vbs" file attached to an e-mail message.
This is a usual Loveletter-like VBS worm, but it is encrypted (encoded) to bypass heuristic scanners.
This worm spreads via e-mail by sending infected messages from infected computers. While spreading, the worm uses MS Outlook and sends itself to all addresses that are stored in MS Outlook Address Book. As a result, an infected computer sends as many messages to as many addresses are kept in MS Outlook contacts list.
It works only on computers on which the Windows Scripting Host (WSH) is installed. In Windows 98 and Windows 2000, WHS is installed by default. To spread itself, the worm accesses MS Outlook and uses its functions and address lists. This is available in Outlook 98/2000 only, so the worm is able to spread only in case one of these MS Oulook versions is installed.
The infected message in the original worm version appears as follows:
Subject = "Homepage"
Body = Hi!
You've got to see this page! It's really cool ;O)
After spreading, the worm randomly opens one of four adult-orientated/pornographic pages to keep a user unaware.
To avoid double spreading from the same machine it creates the "HKCUsoftwareAnmailed" registry key and writes a "1" value to there. This is done so it does not spread from one to the same machine twice.

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Actem

Description I-Worm.Actem

Actem is a worm virus spreading via the Internet as an infected email attachment. The worm itself is a Windows PE EXE file about 61Kb in size, written in Visual Basic.
The infected messages body is empty.
The email Subject is:
"Try this, pretty cool"
There are two files attached to the email. One is a copy of the worm:
ActiveM.exe
While the other is a text file:
list.txt
Actem activates from the infected email only if a user clicks on the attached file. If activated the worm installs itself into the system and displays false messages.
The worm hides itself as an "Active Mouse" application and displays several false messages and menus when the infected file is run.
Actem shows this "active mouse" dialog window:

Other false messages displayed by Actem if executed:




Actem does not install itself to the system and is not active after having run - unless a user clicks on the infected attachment again.
To send out infected messages Actem uses MS Outlook to send messages to all addresses found in the Outlook address book.

I-Worm.Alcaul.h

Description I-Worm.Alcaul.h

This is a virus-worm that spreads via the Internet attached to infected e-mails.
The worm itself is a Windows PE EXE file 5632 bytes in length, and it is written in Visual Basic 6. It is packed by a UPX utility. After unpacking, it is about 16 Kb in length.
Infected messages contain:
Subject: cute worm
Body: the attached file is a compressed picture of a wormall click it..
Attachment: worm.com

The worm activates from infected e-mail only when a user clicks on an attached file. The worm does not install itself to the system and is not activated anymore (except in cases when a user clicks on an attached e-mail again).
To send infected messages, the worm uses MS Outlook and sends messages to all addresses found in Outlook address book.
Installing
While installing, the worm copies itself to disk C: with the name: C:WORM.COM.

Home