Virus Database

MF family

Description MF family

These are dangerous memory resident polymorphic and stealth parasitic viruses. They hooks INT 8, 16h, 21h, 2Fh and write themselves to the end of COM and EXE files that are executed or closed. On opening an infected file the viruses temporary disinfect it.
Depending on their internal counters the viruses change several extended ASCII (cyrillic) letters on the screen. The virus also changes letters that are typed by keyboard.
In 14 minutes after installing memory resident "MF.3564" displays the text "Merlin from AMBER: FUCK YOU MAN!", in 40 minutes the viruses corrupt the CMOS memory. Depending on a random counter the viruses disable accessing to remote disks and files.
When the text "Tell me your ver, mf!" is entered as a DOS command, the viruses display:
"MF.3490": My ver is MF v10.1
"MF.3564": My ver is MF v10.0

When the text "Do your job, mf!" is entered, they display:
Yes, I got it, man.

and then corrupt the CMOS memory.

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Updater.a

Description I-Worm.Updater.a

This is a virus-worm that spreads via the Internet attached to infected e-mails. The worm itself is a Windows PE EXE file about 12Kb in length, and it is written in Visual Basic (VB6). It is packed by the UPX program. After unpacking, it is 45 Kb in size.
The worm activates from an infected e-mail only when a user clicks on an attached file. The worm then installs itself to the system, runs a spreading routine and payload.
The infected messages have different texts and attached file names, they are randomly selected by the worm while spreading from the following variants:
Subjects:
Part1 + Part2 + Part3 + Part4
Part1 = "Have you ", "You Should ", "Just ", "Why Not you ", "How to ", "Re: ", "Fwd : ", " "
Part2 = "Check ", "Check out ", "Watch out ", "Open ", "Look at "
Part3 = "this ", "my ", "For this ", "The "
Part4 = "Picture", "Program", "Patch", "Nude pic", "Report", "Documment", "Quotation", "Transaction", "Bank Account", "WTC Tragedy", "Osama Vs Bush" "Account", "Private Pic"

Examples:
You Should Look at this Osama Vs Bush
Fwd : Check my Patch

Attachment filenames:
"Setup.EXE", "install.exe", "Readme.exe", "Files.exe", "Picture.exe" "Quotation.Doc.exe", "Letter.Doc.exe", "Picture.jpg.exe"
Body:
Hi:
This is the file you ask for, Please save it to disk and open this file, it's very important.
Sample message:

Installation
While installing, the worm copies itself to the C:WINDOWS directory with the UPDATE.EXE name, and registers that file in the system-registry auto-run key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun Update = C:WINDOWSUpdate.exe
The worm then displays the following fake error message:

Payload
The worm creates the file C:WINDOWSSTARTM~1PROGRAMSSTARTUPUpdate.vbs. This script file starts automatically after rebooting a system under Windows 9x/ME. It looks for files on all drives with the following extensions: EXE, DOC, TXT. It creates script copies with the same names plus the extra extension ".vbs". For example:
MPLAYER.EXE.vbs
NOTEPAD.EXE.vbs

This script file contains the strings:
I-WORM.IMELDA.B
(C)2001, by Iwing
Virusindo - Indonesian Virus Network
http://indovirus.8m.com , IRC Dalnet #indovirus

The worm changes the volume label on disk C:, then the IMELDA
The worm also copies itself to the C:WINDOWS directory with one of the following names:
"Setup.EXE", "install.exe", "Readme.exe", "Files.exe", "Picture.exe" "Quotation.Doc.exe", "Letter.Doc.exe", "Picture.jpg.exe"

I-Worm.Valcard

Description I-Worm.Valcard

This is a virus-worm that spreads via the Internet attached to infected e-mails. The worm itself is a Windows PE EXE file about 97Kb in length (compressed by UPX, about 132K when decompressed), and it is written in Visual Basic.
Spreading
To send infected messages, the worm uses MS Outlook, and sends messages to all addresses found in the Outlook address book. The infected messages appear as follows:
The Subject is randomly selected from the following variants:
Secret Admirer
Somebody Loves You
Romance from Afar
Love at first sight
allwhen sleepers wake and yet still dream...
Be Mine ?!
Yours Always
Happy Valentines
From Me To You
Thy eternal summer shall not fade
I can express no kinder sign of love, than this kind kiss
Poetry is an echo, asking a shadow to dance
O, beauty, till now I never knew thee!
Romantic gesture
Good night, sweet prince, and flights of angels sing thee to thy rest
The message Body, followed by a "user name", is selected from the following variants:
Happy Valentines
I hope you like the card I've attached,
even if you don't feel the same.
Febuary Feelings
It's that time of year again.
But I'm still only sedning a card to you.
Happy Valentines
I hope you like the card I've attached,
even if you don't feel the same.
Hi
I feel like a child sending you this card
but I just had to do it.
Happy Valentines
I hope you like the card I've attached,
even if you don't feel the same.
...and every breath I ever took,
every tear I ever wept,
Every star I wished upon,
Seemed nothing until now.
Happy Valentines
I hope you like the card I've attached,
In this life we cannot do great things.
We can only do small things with great love.
Happy Valentines
I hope you like the card I've attached,
even if you don't feel the same.
Attachment: ValentineCard.exe
Installing
The worm activates from infected e-mail only when a user clicks on an attached file. The worm then installs itself to the system, runs a spreading routine and payload.
While installing, the worm copies itself to the Windows system directory with the "ValentineCard.exe" name, and registers that file in the system registry auto-run key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun 14th = %SystemDir%ValentineCard.exe
where %SystemDir% is Windows system directory.
Payload
Upon being installed, the worm writes a "not a first run" registry key:
HKLMSoftwareMicrosoftWindowsCurrentVersion Valentine = true
and then operates depending on this key's presense. Because of a bug, on any run (first run, second run,...), the worm does the same thing: it creates "C:evil.jpg", writes sound data to there and opens it. Because the file has a wrong extension (".jpg" picture, not ".wav" sound), the system fails to accept it. In case this file is renamed to ".wav", it plays the "Somebody loves you" phrase.
The worm should also (but fails) create the "C:1.wav" file, and open its window. The worm's program window should have a moving title:
I Love You !
on the "About" button, it should display the following message:
Flash Player
Flash Player 4.0
Copywrite (C) 1996-1999 Macromedia, Inc.
http://www.macromedia.com

On Thursdays, the worm should (but fails) restart Windows.

Home