Originally known under alias Win32.HLLP.Quizy used by virus author Gigabyte (author is a female if you're still thinking otherwise). However, AV companies have a policy against naming virus or worm which author wanted to use. As I'm using Kaspersky Labs alias, the full alias name by Kaspersky Labs for this worm is Email-Worm.Win32.Qizy.
Other aliases (just names) are: Quiz, Qizy, Izuqy, Quis, Quiz, Belzy
It will infect all files in Personal Folder Shell (by default it's My Documents folder), while it will infect Windows folder only if it's running NT version. Worm drops startup.exe (runs at startup as it's added in Run entry in HKLM and it asks 10 questions which should be answered to find out how to disinfect your PC) and xmas.scr (worm copy) in root folder, Mail.vbs (which is quickly gone, used for sending emails) and jbells.rtx ringtone in System folder.
Infected files run worm and original program by extracting it from infected file under name origfile.exe. However, it's only there for short time, so unless it's copied quickly, it's removed.
Appears on these pages
Quizy is a viral worm that makes the computer user answer ten questions in order for it to not...