Virus Database

I-Worm.Lee-SaltLake

Description I-Worm.Lee-SaltLake

This is a simple worm that replicates through e-mail messages and IRC channels.
The worm arrives in an infected message with an attached VBS file, which is actually the worm's body. Infected messages have the following properties:
Subject: You get off the ice and respect the referees decision
Message body: Do you agree with the judge''s decision to disqualify a Korean skater and award Apolo Ohno the gold medal Wednesday night?
Attachment name: SALTLAKE.jpg.vbs

When the worm is launched (when the is worm clicked in an infected file), it copies itself to the Windows system directory with the "SALTLAKE.jpg.vbs" name and registers this file in the registry autorun key.
Then the worm finds the directory where the mIRC client is installed and creates there a "SCRIPT.INI" file. The worm writes in its commands that send the worm's body to each computer that connects to IRC channels, to which an infected computer is connected.
After creating the "SCRIPT.INI" file, the worm writes an infection mark to the system registry. This mark prevents the worm from writing to the "SCRIPT.INI" file again.
This worm was created using the worm constructor "Vbs Worms Generator", which was written by the hacker with the pseudonym [K]alamar. This constructor was also used to create the "Anna Kournikova", "Antrax" and other worms.

Check other viruses! Be aware! Use Antiviral Software

Companion.Inrar.333

Description Companion.Inrar.333

This is a harmless, non-memory resident companion virus. It searches for RAR files, precesses internal RAR formats, looks for EXE files in there, renames a file with an .EX_ extension and adds to the archive its own copy with the name of the victim's file and .EXE extension.
The virus contains the text string:
*.rar
[ InRarCompanion ]

Compiac.379

Description Compiac.379

Compiac is a dangerous memory resident parasitic virus. It copies itself into the Interrupt Vectors Table, hooks INT 21 and writes itself to the end of EXE files that are accessed. The virus deletes *.M? files, contains the text string:
COMPIAC

Home