Virus Database

I-Worm.Mimail.j

Description I-Worm.Mimail.j
This worm is a modification of I-Worm.Mimail.i
It spreads via the Internet as a file named InfoUpdate.exe attached to infected messages. The worm itself is a Windows PE EXE file, packed with UPX. The size of the compressed file is approximately 13KB and the size of the decompressed file is approximately 30KB.
Characteristics of infected messages:
Sender's address:
Do_Not_Reply@paypal.com
Message header
IMPORTANT
Message body
Dear PayPal member, We regret to inform you that your account is about to be expired in next five business days. To avoid suspension of your account you have to reactivate it by providing us with your personal information.
To update your personal profile and continue using PayPal services you have to run the attached application to this email. Just run it and follow the instructions. IMPORTANT! If you ignore this alert, your account will be suspended in next five business days and you will not be able to use PayPal anymore.
Thank you for using PayPal.
Attachment name:
www.paypal.com.pif or InfoUpdate.exe
All other details, such as how the worm installs itself, manifests itself in the system and replicates are the same as I-Worm.Mimail.i

Check other viruses! Be aware! Use Antiviral Software

Death.1001

Description Death.1001

Death is a not dangerous non-memory resident encrypted parasitic virus. It searches for .COM files (by using the mask "*.COM") and writes itself to the end of these files. On the 10th generation it types the message "Bad command or file name" and leaves in memory a memory resident program which hooks onto INT 09h (keyboard). When the Alt-Ctrl-Del keys are pressed in combination it types the following message and hangs the computer:
Your PC has lapsed into a higher state of beingall
D E A T H
Please, feel free to cold boot,
as nothing has been damaged,
it was only a near death
experience
Your PC should meditate more often,
'cuz with all the evil viruses
flowing around neurospace
we wouldn't want this
to become a real
D E A T H
[Death] The Attitude Adjuster, VG, 12/02/92

DeathBoy.912

Description DeathBoy.912

These are dangerous memory resident encrypted parasitic viruses. They search for COM and EXE files, then they write themselves to the end of the file. While infecting they erase the part of the system memory, that may cause the system crash. "DeathBoy.912" corrupts the CMOS. The viruses contain the text strings:
"DeathBoy.640": KaLi-4 / Köhntark
"DeathBoy.893": 1994 virus=DeathBoy was here
"DeathBoy.912": [BAD MOTHER BOARD] VIRUS=DeathBoy was here

Home