Virus Database

I-Worm.Prolin (a.k.a. Creative)

Description I-Worm.Prolin (a.k.a. Creative)

This is a virus-worm that spreads via the Internet by using MS Outlook. The worm itself is a Windows EXE file about 37Kb in length, and written in VisualBasic. The worm uses a standard MW97_Melissa-like way of spreading: it opens the MS Outlook address book, obtains addresses from there, and sends its copies to these addresses. The message reads as follows:
Subject: A great Shockwave flash movie
Message text:
Check out this new flash movie that I downloaded just now all It's Great
Bye
Attach name: creative.exe

The worm then sends a "notification" message to its author and informs him about the next infected computer:
To: z14xym432@yahoo.com
Subject: Job complete
Message text: Got yet another idiot

The worm also creates its copies on the C: disk with the following names:
C:creative.exe
C:WINDOWSStart MenuProgramsStartUpcreative.exe
The second copy is placed in the auto-run directory so it will be activated upon each Windows restart.
The worm has a dangerous payload. It scans all disk drives, obtains ZIP, MP3, and JPG files, and renames them to C: drive with the following name:
C:\%victimfile%change atleast now to LINUX
for example, BGAMEX.JPG and DATA.ZIP are moved to:
C:BGAMEX.JPGchange atleast now to LINUX
C:DATA.ZIPchange atleast now to LINUX
The worm also creates the text file "c:messageforu.txt", writes the text there and adds list of removed files, such as the following:
Hi, guess you have got the message. I have kept a list of files that I
have infected under this. If you are smart enough just reverse back the
process. i could have done far better damage, i could have even
completely wiped your harddisk. Remember this is a warning & get it sound
and clear... - The Penguin
C:WINDOWSSYSTEMOOBEIMAGEXBGAMEX.JPG
C:BACKUPDATA.ZIP

Check other viruses! Be aware! Use Antiviral Software

Mini.60.a

Description Mini.60.a

These are extremely primitive non memory resident harmless viruses. They write themselves to all .COM files of the current directory. The peculiarity of these viruses is their small length. All infectors contain the string "*.COM" or "*.com".
The length of files getting infection by "Mini.127.b" virus grows for 127+n bytes, where 'n' is the number of virus generation.
"Mini.132" contains the text "Foxy".
"Mini.200" contains the text "Tony".
"Mini.207" infects the files that have a block of 207 zero bytes. The virus inserts into this "zero" block, the length if the file does not grow.
"Mini.233" on Friday, 13th decrypts and displays the string:
VirX 3/90

Mini_HHHH.246

Description Mini_HHHH.246

It is a harmless nonmemory resident parasitic virus. It searches for .COM files and writes itself to the end of the file. It contains the text string:
The MiNi-HHHH

Home