Threat description


Category: Malware
Type: Virus
Platform: W32
Aliases: Vienna.Bua, Bua, Butthead, Big Caibua, Vienna.2279


This virus was spread through some BBS and ftp sites in May 1995. The virus activates in on May 5th, 1995. At this time it will display a graphic image of phallus. At a later time, the virus will try to cause damage by formatting track zero, deleting the first file in a directory, creating sub-directories with obscene names etc.Bua contains the following texts in encrypted form:

RABID is Actually NAMBLA.   Go figure   High Evolutionary Sucks BIG CAIBUA!   You bastardize code, I bastardize it again!  Fuck You!   Difference is you cocksucker, I can actually program in assembler.   Read about it in VSUM!   btw, Patty, Howabouts ya lick my BIG CAIBUA?   Oh, And John, Just in case you think I forgot your sorry ass.   The next one is for you!!!  Muhahahahahahahahahaha!!!!   O.J. IS GUILTY!!   Tempest, Live for yourself.   You do not know what love is yet.   wait, it will come.   No worries.  

Vienna.Bua has been distributed on a CD-ROM as well, shareware collection "Night Owl #16" has it in file \051A\BESTSSVR.ZIP.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


More information on scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More