Malware Wiki - Recent changes [en]

Happy99

2013-05-15T23:52:18Z

Gree443 protected "Happy99"‎ ‎[edit=sysop] (indefinite) ‎[move=sysop] (indefinite)

Thread:74.221.158.157/@comment-Seanbot582-20130515201928

2013-05-15T20:19:29Z

Created page with "Hi, welcome to {{SITENAME}}! Thanks for your edit to the Anthrax page. '''Please sign in and create a user name'''. It's an easy way to keep track ..."

New page

Hi, welcome to {{SITENAME}}! Thanks for your edit to the [[:Anthrax]] page.

'''[[Special:Userlogin|Please sign in and create a user name]]'''. It's an easy way to keep track of your contributions and helps you communicate with the rest of the community.

Please leave me a message if I can help with anything!<ac_metadata title="Welcome to Malware Wiki!"> </ac_metadata>

Talk:Anthrax/@comment-74.221.158.157-20130515194725

2013-05-15T19:47:25Z

Created page with "das sexy"

New page

das sexy

Pikachu

2013-05-14T00:13:15Z

ExploreZip

2013-05-13T23:43:13Z

File:Expzip.jpg

2013-05-13T23:42:43Z

Gree443 uploaded "File:Expzip.jpg"

Shoerec

2013-05-13T23:35:03Z

File:W32-shoerec.gif

2013-05-13T23:34:09Z

Gree443 uploaded "File:W32-shoerec.gif"

Home Page

2013-05-13T23:25:01Z

Gree443 protected "Home Page"‎ ‎[edit=autoconfirmed] (indefinite) ‎[move=autoconfirmed] (indefinite)

Shoerec

2013-05-13T23:19:51Z

Created page with "{{Infobox_software |name = Shoerec |latestreleaseversion_date = 2000.03.21 |type = File virus}} Shoerec is a virus with a payload similar to that of Magistr. Anothe..."

New page

{{Infobox_software
|name = Shoerec
|latestreleaseversion_date = 2000.03.21
|type = File virus}}

Shoerec is a virus with a [[payload]] similar to that of [[Magistr]]. Another part of its payload pays tribute to the [[Brain]] virus.

==Behavior==

[[File:2,000 Subscribers - Shoerec Windows Virus|thumb|right|312 px]]

When executed, Shoerec generates a random letter andf searches for all files in the current directory with that name three times. It infects Portable executables, hiding as a process thread and then appending itself to the file.

Four months after the initial infection, the virus activates a payload similar to that of [[Magistr]]. It causes icons to move away from the cursor as if trying to run away from it.

There is another payload that activates on the 1st, 2nd or 3rd of any month. It infects files on these days with a trojan routine. Seven months after infecting the files, the routine will erase all files on the current drive. It also createsd and overwrites the WIN.COM with either random junk or the following text (paying homage to [[Brain]]):

(c) 1999 Brain & Amjads (pvt) Ltd
VIRUS_SHOE RECORD v20.0
Dedicated to the dynamic memories of millions of virus
who are no longer with us today - Thanks

==Origin==

Shoerec was originally posted to newsgroups as the files FUN.EXE, BOXING.EXE or NOSTRESS.EXE. Its icon made it look like a Shockwave file. When executed, it showed an image of a boxer.

==Sources==

Kaspersky Lab. SecureList, [http://www.securelist.com/en/descriptions/old20063 Virus.Win9x.Shoerec.] 2001.01.14

Proland, [http://www.proland.net/virus_info/win32/shoerec.htm Shoerec virus]
[[Category:Virus]]
[[Category:MSWindows virus]]
[[Category:Win9x virus]]
[[Category:Win32 virus]]
[[Category:File virus]]
[[Category:MSWindows]]

File:2,000 Subscribers - Shoerec Windows Virus

2013-05-13T23:17:44Z

Adding video description

File:2,000 Subscribers - Shoerec Windows Virus

2013-05-13T23:17:43Z

Gree443 uploaded "File:2,000 Subscribers - Shoerec Windows Virus" created video

Thread:173.216.252.145/@comment-Seanbot582-20130513202936

2013-05-13T20:29:36Z

Created page with "Hi, welcome to {{SITENAME}}! Thanks for your edit to the MyWebSearch page. '''Please sign in and create a user name'''. It's an easy way to keep tr..."

New page

Hi, welcome to {{SITENAME}}! Thanks for your edit to the [[:MyWebSearch]] page.

'''[[Special:Userlogin|Please sign in and create a user name]]'''. It's an easy way to keep track of your contributions and helps you communicate with the rest of the community.

Please leave me a message if I can help with anything!<ac_metadata title="Welcome to Malware Wiki!"> </ac_metadata>

Talk:MyWebSearch/@comment-173.216.252.145-20130513193202

2013-05-13T19:32:02Z

Created page with "HARLEYDAVS"

New page

HARLEYDAVS

User:Gree443

2013-05-13T09:30:05Z

User:Gree443

2013-05-13T09:25:09Z

Seanbot582 changed group membership for User:Gree443 from (none) to administrator, bureaucrat and Chat moderator We need more admins bureaucrats and chat mods.

Sean the hedgehog

2013-05-13T09:20:52Z

Seanbot582 deleted page Sean the hedgehog content was: "Sean the Hedgehog is a coder of worms. ===List of worms=== *Kulpark-Mass mailer worm reported by danooct1. *Xerox-IRC worm reported by Anonymous Use..." (and the only contributor was "Seanbot582")

Thread:Gree443/@comment-Seanbot582-20130513091020

2013-05-13T09:11:21Z

Thread:Gree443/@comment-Seanbot582-20130513091020

2013-05-13T09:10:21Z

Created page with "Hello!Would you like to be admin?<ac_metadata title="Hello!(안엿하세여!)"> </ac_metadata>"

New page

Hello!Would you like to be admin?<ac_metadata title="Hello!(안엿하세여!)"> </ac_metadata>

Thread:64.217.181.32/@comment-DeeMoShow-20130509224604

2013-05-09T22:46:04Z

Created page with "Hi, welcome to {{SITENAME}}! Thanks for your edit to the Creeper page. '''Please sign in and create a user name'''. It's an easy way to keep track ..."

New page

Hi, welcome to {{SITENAME}}! Thanks for your edit to the [[:Creeper]] page.

'''[[Special:Userlogin|Please sign in and create a user name]]'''. It's an easy way to keep track of your contributions and helps you communicate with the rest of the community.

Please leave me a message if I can help with anything!<ac_metadata title="Welcome to Malware Wiki!"> </ac_metadata>

Creeper

2013-05-09T22:44:23Z

‎Contraversies: - minor spelling error fix

← Older revision		Revision as of 00:13, May 14, 2013
Line 1:		Line 1:
−	[[File:65786586.jpg\|thumb\|180px\|The Pikachu virus]]	+	{{Infobox_software
		+	\|name = Pikachu
		+	\|image = [[File:65786586.jpg\|215px]]
		+	\|latestreleaseversion_date = June 28, 2000\|url = www.Pikachu.com}}
	The Pikachu worm was the first worm aimed at children. It was sent in the form of an email, called Pikachu. The message said Pikachu is your friend. When users opened the attachment, it showed a pensive Pikachu, and text that read "Between millions of people around the world I found you. Don't forget to remember this day every time MY FRIEND!", with an unworking link to 'pikachu.com'.		The Pikachu worm was the first worm aimed at children. It was sent in the form of an email, called Pikachu. The message said Pikachu is your friend. When users opened the attachment, it showed a pensive Pikachu, and text that read "Between millions of people around the world I found you. Don't forget to remember this day every time MY FRIEND!", with an unworking link to 'pikachu.com'.

@@ Line 5: / Line 5: @@
 ! Type
 | Mass-mailer worm
 |-
 ! Creator
-−
+|
 |-
 ! Date Discovered
 | 1999.06.06
 |-
 ! Place of Origin
 | Israel?
 |-
 ! Source Language
 | Delphi
@@ Line 26: / Line 26: @@
 ! Reported Costs
 | $1.02 billion
 |}
@@ Line 44: / Line 43: @@
    <sender name>
-[[Image:Exzimes.png|thumb|right|450px|The ExploreZip Message.]]
+[[Image:Expzip.jpg|thumb|right|450px|The ExploreZip Message.]]
 The attachment is named Zipped_files.exe. When executed, ExploreZip displays a message saying that the zip archive is invalid. The message is always in English, but the OK button is in the language that the particular computer being infected is set to. The worm copies itself to the [[VirusInfo:Operating_System_Reference#System_Folder|Windows System Folder]] under the name Explore.exe or _setup.exe. The worm may also be found in a temporary folder, or email attachments folder, depending on the mail client the computer uses. It will modify the Win.ini file in Windows 95/98 and add its file name to the [[VirusInfo:Operating_System_Reference#Startup_Registry_Keys_and_Details|Current User registry key]] in Windows NT, 2000 and XP, which will cause the worm to run when the computer starts up (not ...\CurrentVersion\Run, like most worms, but rather ...\CurrentVersion\Windows).
 ExploreZip searches for files on drives C to Z of the infected computer and any drives accessable through networks for files with .h, .c, .cpp, .asm (these first four are types of source code), .doc, .ppt, or .xls (Microsoft Office documents, presentations and spreadsheets). The worm then calls CreateFile(), which makes those files 0 bytes long. The files are unrecoverable. New files created after the worm infection will be deleted until the worm is removed. The user may notice the increased hard drive activity.
-The worm replies to all unread messages in the inbox and marks the message as read so it will not send itself to that email address from the present computer again. The worm will send its reply to every new email the computer receives until it is removed. It will also copy itself to the Windows or WINNT folders of computers on the presently  infected computer's network.
+The worm replies to all unread messages in the inbox and marks the message as read so it will not send itself to that email address from the present computer again. The worm will send its reply to every new email the computer receives until it is removed. It will also copy itself to the Windows or WINNT folders of computers on the presently infected computer's network.
 ==Effects==
@@ Line 80: / Line 79: @@
 F-Prot Antivirus Virus Information, [http://www.f-prot.com/virusinfo/descriptions/explorezip_e.html W32/ExploreZip.E]
 [[Category:Worm]]
 [[Category:Email worm]]

@@ Line 1: / Line 1: @@
 == Description ==
-Category: Entertainment
+Huge thanks to all of you who continue to watch, rate, comment and enjoy my videos. Also, big thanks to FlightCPUBoy for finding this virus that activates in a similar manner to one of my favorite virus/worm hybrids of all time, Magistr.
 [[Category:Videos]]

← Older revision		Revision as of 09:30, May 13, 2013
Line 1:		Line 1:
−	[[File:Placeholder\|thumb\|220px]]	+	Hello!My name is Gree!Welcome to my profile![^_^]
−
−	This is your user page. Please edit this page to tell the community about yourself!
−
−	==My favorite pages==
−
−	* Add links to your favorite pages on the wiki here!
−	* Favorite page #2
−	* Favorite page #3

← Older revision		Revision as of 09:11, May 13, 2013
Line 1:		Line 1:
−	Hello!Would you like to be admin?<ac_metadata title="Hello!(안엿하세여!)"> </ac_metadata>	+	Hello!Would you like to be admin?
		+	안녕하세요! 당신은 관리자 권한이 있습니까?<ac_metadata title="Hello!(안엿하세여!)"> </ac_metadata>

@@ Line 1: / Line 1: @@
 {{Infobox_software
 |name = Shoerec
 |latestreleaseversion_date = 2000.03.21
-|type = File virus}}
+|type = File virus|image = [[File:W32-shoerec.gif|215px]]
 Shoerec is a virus with a [[payload]] similar to that of [[Magistr]]. Another part of its payload pays tribute to the [[Brain]] virus.

@@ Line 53: / Line 53: @@
 ''Although it is technically a violation of the Virus Encyclopedia's policy forbidding viral/worm sources or binaries to be posted to any page here, Creeper and the OS that it ran on are so old that there is next to no harm in them being posted here. If you have Creeper in binary or source form, please do not hesitate to upload it to this Wiki, as that would be greatly appreciated. As for any safety concerns, we will assume that anyone still running a TENEX machine from circa 1970 is intelligent and experienced enough to protect his/her computer.''
-==Contraversies==
+==Controversies==
 Most sources claim Creeper ran through the DARPANET in the early 1970's, but David Sims's article in Wired says it was in the late 1960's. Some articles are a bit more exact, but they are no more consistent.