Classification

Category: Malware

Type: Worm

Aliases: Pikachu, Pokey, Pokemon, I-Worm.Pikachu

Summary


The hyped-up 'Pokey' virus doesn't seem to be widespread.

Pikachu is an Internet worm that spreads itself as an executable file attachment using Microsoft Outlook. The worm was written in Visual Basic 6 and it requires VB6 libraries to be present in a system to run.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


The worm usually arrives in an email message that looks like that:

Subject: Pikachu Pokemon
Body:
Great Friend!
Pikachu from Pokemon Theme have some friendly words to say.
Visit Pikachu at http://www.pikachu.com
See you.

The worm is attached to this message as the PIKACHUPOKEMON.EXE file. The file has an icon resembling Pikachu character.

When a user clicks on the attachment, the worm is activated. It shows a dialog with Pikachu image and the following text:

Between millions of people around the world i found you.
Don't forget to remember this day every time MY FRIEND!
Visit us at http://www.pikachu.com

The dialog that the worm shows upon activation looks like that:

Then the worm accesses Outlook address book and sends messages with its body attached to everyone in this address book.

The worm has a dangerous payload. It adds several commands to AUTOEXEC.BAT file that will delete \Windows\ and \Windows\System\ folders when a system is restarted. A system asks confirmation to delete files, so if a user doesn't press 'Y', his files are not deleted.