Threat description
This virus is a bit unusual, to say the least. It contains the following message:
This program is infected by a HARMLESS Text-Virus V2.1 Send a FUNNY postcard to : Sylvia Verkade, Duinzoom 36b, 3235 CD Rockanje The Netherlands. You might get an ANTIVIRUS program.....
It will display this message when an infected program is executed, but if the above text is tampered with, the following message, (which is stored in an encrypted form) will appear instead:
FUCK YOU LAMER !!!! system halted...$
Some people have a weird sense of humor...
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.
Two versions are known, only slightly different - possibly modified to avoid some anti-virus program. When an infected program is run, the virus will seek out up to 5 .COM files to infect. It will search drive C: and the current drive. The three system files, COMMAND.COM, IBMBIO.COM and IBMDOS.COM are not infected. The virus adds 1301 bytes to the beginning of the files it infects (and also 31 bytes to the end), but does no other damage. The girl mentioned above exists, but she says that she has no idea who the author is, although there is a rumor he is her ex-boyfriend.
Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis
Give advice. Get advice. Share the knowledge on our free discussion forum.