Virus Database

Kasimir family

Description Kasimir family

These are dangerous nonmemory resident parasitic viruses. They search for .EXE files and write themselves to the end of the file. Since 1994 they erase the FAT on the C: drive and display the message:
KASIMIR STRIKE NOW!

The viruses also contain the text:
SV00 Lubj

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Voltan (aka Zelig)

Description I-Worm.Voltan (aka Zelig)
Voltan is an Internet worm spreading via the email addresses stored in Windows address books.
Il momento e' catartico
Messages to beware of have the following body text:
Ricevo e cortesemente inoltro,all. un premio per la genialita
hanno reso mitico un salva schermo scaricalo, "poesie
catartiche", che
non sai cosa ti perdi

ciao
There is a link to a web site where a copy of the Voltan worm resides.
Additionally, the worm replaces the screen saver with a scrolling text line stating:
A volte ti sento cosi vicina...A volte ti sento cosi
lontana...Certo che hai proprio un cellulare di merda!
The worm is a Windows executable file about 36 KB in size when compressed with ASPack. The uncompressed size is about 70KB. Voltan is unable to function in the operating system environments of Windows 95, 98, ME, and NT4.

I-Worm.Vote

Description I-Worm.Vote

This Internet worm spreads via e-mail messages using MS Outlook. Upon being executed, the worm sends infected messages to all addresses stored in the Outlook address book, then it overwrites all HTML files on the local disk drives. Upon the next Windows start-up, the worm tries to delete all files in the Windows folder, and reboots the computer.
The worm arrives to a computer as an e-mail message with an attached executable file that is the worm itself. The malicious message contains the following:

The worm doesn't run automatically from e-mail. It is activated only when a user starts it manually (by double-clicking on the attachment).
Upon being executed, the worm sends infected messages to all addresses stored in the Outlook address book. Then it opens two Internet browsers utilizing sites that are closed at the moment. Also, it replaces the Internet Explorer start-up page with one of its own. Following this, the worm drops two different VBS files.
The first one is named "MixDaLaL.vbs" that the worm creates and runs immediately in the Windows folder. This file has a script program that searches for files with HTM and HTML extensions on all removable and local hard drives, and overwrites them with a short text:
AmeRiCa allFew Days WiLL Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For You
The second VSB file the worm drops into the Windows system folder with the name, "ZaCker.vbs", and registers it in the auto-run registry section. This means the file will be automatically executed upon the next Windows start-up. Upon being executed, it attempts to delete all files in the Windows directory, overwrites AUTOEXEC.BAT with a command destroying all data on drive C:, and then it displays the following message:

The worm finally reboots the computer. As a result, the system may be rendered unbootable or all data may be destroyed.

Home