Virus Database

I-Worm.Mawanella

Description I-Worm.Mawanella

This Internet worm spreads via e-mail messages using MS Outlook. The worm is written in Visual Basic Script language (VBS) and spreads as a "Mawanella.vbs" file attached to an e-mail message.
This is a typical Loveletter-like VBS worm; however, it is encrypted (encoded) to bypass heuristic scanners.
This worm spreads via e-mail by sending infected messages from infected computers. While spreading, the worm uses MS Outlook, and sends itself to all addresses that are stored in the MS Outlook Address Book. As a result, an infected computer sends as many messages to as many addresses that are kept in the MS Outlook contacts list.
It works only on computers on which the Windows Scripting Host (WSH) is installed. In Windows 98 and Windows 2000, WHS is installed by default. To spread itself, the worm accesses MS Outlook and uses its functions and address lists. This is available in Outlook 98/2000 only, so the worm is able to spread only in the case that one of these MS Oulook versions is installed.
The infected message in the original worm version appears as follows:
Subject = "Mawanella"
Body = "Mawanella is one of the Sri Lanka's Muslim Village"
Attached file name = "Mawanella.vbs"

If a computer doesn't have MS Outlook installed, the worm simply displays a message:
Please Forward this to everyone
After spreading, the worm displays the following message:

The worm doesn't mark infected computers in any way, thus it will send infected messages each time a user activates the worm's VBS file.

Check other viruses! Be aware! Use Antiviral Software

Hitch.1238

Description Hitch.1238

These are not dangerous memory resident parasitic viruses. They hook INT 1Ch, 21h and write themselves to the beginning of the COM files. The viruses play a tune.

Hitler

Description Hitler

It is not a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h and writes itself to the end of COM files that are executed. Sometimes this virus tries to speak several words by the internal speaker. The virus contains the text string:
Hitler Virus by Dreamer/DY



Oct-14-1996:
renamed to "Dreamer.4808" - see "Dreamer Family"

Home