Virus Database

I-Worm.Homepage

Description I-Worm.Homepage

This is an Internet worm that widely spread on 9 May 2001. The worm is written in Visual Basic Script language (VBS) and spreads as a "homepage.HTML.vbs" file attached to an e-mail message.
This is a usual Loveletter-like VBS worm, but it is encrypted (encoded) to bypass heuristic scanners.
This worm spreads via e-mail by sending infected messages from infected computers. While spreading, the worm uses MS Outlook and sends itself to all addresses that are stored in MS Outlook Address Book. As a result, an infected computer sends as many messages to as many addresses are kept in MS Outlook contacts list.
It works only on computers on which the Windows Scripting Host (WSH) is installed. In Windows 98 and Windows 2000, WHS is installed by default. To spread itself, the worm accesses MS Outlook and uses its functions and address lists. This is available in Outlook 98/2000 only, so the worm is able to spread only in case one of these MS Oulook versions is installed.
The infected message in the original worm version appears as follows:
Subject = "Homepage"
Body = Hi!
You've got to see this page! It's really cool ;O)
After spreading, the worm randomly opens one of four adult-orientated/pornographic pages to keep a user unaware.
To avoid double spreading from the same machine it creates the "HKCUsoftwareAnmailed" registry key and writes a "1" value to there. This is done so it does not spread from one to the same machine twice.

Check other viruses! Be aware! Use Antiviral Software

Leonardo.2085

Description Leonardo.2085

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus deletes the anti-virus databases: ANTI-VIR.DAT, FINGERP.VVF, FILES.VVL, CHKLIST.MS, *.CRC. Depending on the system time the virus displays the message:
This is Leonardo - another virus Ninja Turtle
Press any keyall.

The virus also contains the text:
Origin :Slovakia (not Hungaria or Austria)

Leproso.1221

Description Leproso.1221

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the beginning of .COM files (except COMMAND.COM) are executed or opened. While infecting the virus creates a temporary file. Depending on the system date it displays the message:
Felicitaciones su máquina esta infectada por el virus LEPROSO creado por
J.P.G., hoy es mi cumpleaños y lo voy a festejar formateando su rígido!!!
Byeall(Vamos Ñull que con Diego somos campeones)
CopyRight (C) 1993 hasta 2000, J.P.G., Rosario, Argentina

and then halts PC. The virus also contains the text strings:
Diego_es.NOB
MOC.DNAMMOC

Home