Virus Database

Worm.Win32.Datom

Description Worm.Win32.Datom

This is a network worm. It replicates via shared network resources. The worm consists of 3 different files:
MSVXD.EXE
MSVXD16.DLL
MSVXD32.DLL

The first component, MSVXD.EXE activates the worm by loading the MSVXD16.DLL library. In turn, MSVXD16.DLL loads the MSVXD32.DLL component, which performs the worming operations.
Replication
The worm searches for available network resources and tries to connect to their host computers. If the connection has been successfull, the worm then searches for a shared directory that appears to be the Windows directory: it tries the "WinNT" name, and also tries to read the "WinDir" section in the MSDOS.SYS file (if it exists and is available). Then the worm copies all its components to the remote Windows directory, and then sets MSVXD.EXE up to start with Windows automatically: if there is file called "Win.ini" in the remote Windows directory, it writes "MSVXD.EXE" string in the "Run" section of this file, otherwise it creates a link file pointing to MSVXD.exe and called "VxD Manager.lnk" in the common ("All users") Startup directory on the remote computer.
Other
The worm searched for the presence of the ZoneAlarm firewall, and tries to terminate its active instances. It also tries to send "notification" e-mail messages to one of two different addresses that may belong to the author of the worm. These messages contain information about the infected system.

Check other viruses! Be aware! Use Antiviral Software

Slovakia.Silvia5

Description Slovakia.Silvia5

This a harmless non memory-resident encrypted parasitic virus. It searches for COM files, then writes itself to the end of the file. After infection it may display the messages:
Hi, my name is Silvia 5.
I come to visit you.
Please wait, exploring your system..
Preparing new mutation clone..
Looking for friends, cloning..
Sending message..
Answering messages..
Ok, it was nice to meet you. Press any key.

Slow.1716

Description Slow.1716

This is a relatively harmless memory resident encrypted virus. It hooks INT 21h, and infects COM and EXE files that are executed. On Friday, it sets the date stamp to zero for files that are closed.

Home