Worm.P2P.Achar.a
Description Worm.P2P.Achar.a
This is a family of harmless worms that replicate by making their copies in a Kazaa shared folder.
The worm is a Windows application (PE EXE file) written in Assembler, the worm file size is about 8K.
The worm does not install itself into the system.
To infect Kazaa shared folder the worm reads its name from system registry and copies itself to the folder with following names:
'Crack McAfee 7.exe'
'Crack Norton 3000.exe'
'Borland KeyGens.exe'
'MP3 encoder_decoderV1.8.exe'
'HackNTTools.zip .exe'
'SophosCrackAllVersion.exe'
'BitDefender.KeyGen.exe'
'Nod32Crack.exe'
'PANDA.lusers.exe'
'PANDA.AVers.lusers.exe'
The worm also tries to copy itself with the "CUCARACHA.exe" name to startup directories on remote computers, but fails because of a bug. So, it is pure P2P worm.
The worm has "copyright" text string:
-/Cucaracha- Programado por ErGrone * SANTIAGO DE CHILE
Check other viruses! Be aware! Use Antiviral Software
CriminalWW.1788
Description CriminalWW.1788
These are very dangerous memory resident parasitic polymorphic viruses. They trace and hook INT 21h, then they write themselves to the end of COM and EXE files that are executed or opened. Depending on their internal counters the viruses erase the MBR of the hard drive and then display the message:
Criminal!
by WW /DC
The viruses also contain the text string:
Wild W0rker /DC
Cripple.403
Description Cripple.403
It is not a dangerous nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. Before returning to the host program the virus decrypts and displays the text:
What Fucked Ass Has Written FATMAN?
It Was A Cripple Of A Virusall
...It Crashed Every Time
If You Cant Write A Virus ... Let It Be
FATMAN Was Crippled By An Ass Hole And Rescued By
Spooky. Austria 1996
|