Win32.HLLW.Poetas.a
Description Win32.HLLW.Poetas.a
Win32.HLLW.Poetas.a belongs to a family of worms which spread by copying themselve to removable storage media, diskettes and all accessible disks.
Worms from this family seem to be written in Cuba.
This worm is a Windows PE EXE file, approximately 350KB in size.
On launch, it copies itself to a range of system folders:
c:Archivos de programa
C:Archivos de programa
C:Program Files
C: Microsoft Office
Archivos de programa
Archivos comunes
Common Files
Winzip
and also copies itself to the D: and E: drives under the names listed below:
Poetas2.exe
Poetashuevos3.exe
Poetashuevos4.exe
Osama.exe
Binladen.exe
Cocina2.exe
Perdon.exe
services.exe
These files are then registered in the system registry, to ensure they are executed each time the system is started, under a range of names.
Check other viruses! Be aware! Use Antiviral Software
Falopa.548
Description Falopa.548
This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of EXE files that are accessed. On December 25th, the virus displays the following text:
No se metan en el
camino de la droga
que somos muchos
y hay poca.
Falopa Virus Parana
Falus.1181
Description Falus.1181
It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed or accessed by FindFirst/Next FCB DOS calls (DIR command). While installing memory resident the virus leaves in memory the code of host program. In case of an error while infecting a file the virus erases random selected sector. The virus contains the text:
FALUS POTRUS Is Fucking You.
|