Back to the Homepage
german version

An easy guide to build yourself a PC
Hardwaretests: Testresults and benchmarks
Viruses: Prophylaxis, identification, removal

All About PC - get in contact
All About PC - Impressum
Links

 Latest Reviews 

Click to read the review!
ABIT VP6
Click to read the review!
ASUS A7V133
Click to read the review!
EPOX 8KTA3+
Click to read the review!
DEEP OCEAN SCREEN SAVER

 Reviews 
 Virus Descriptions 


Danger
Diffusion

The melissa-Clone Prilissa is the second known virus, which has an surprise for you on christmas. You should protect yourself and load the update of Dr. Solomons virusscanner down.

Prilissa:

Virus name

W97M/Prilissa

Type

Word Makro Virus

Operating systems

Windows 9x

Variants

W97M/Moslem.A, W97M/Pri.q, W97M/Melissa-ag, W97M/Melissa.w, Melissa.w

Infection:
Prilissa infects Word 97-files and spreads over to other PCs via Outlook. It sends itself in an email with the subject "Message from <Word 97 Username>" and the emailtext "This document is very important and you’ve GOT to read this!!!". This emails will be send only one time to the first 50 (!!)  entries in your adressbook.

Payload:
After the virus has sent the 50 emails it infects the NORMAL.DOT, so that every new opened or saved document will be infected too. At the 25th of december the real payload is started. Prilissa overwrites the AUTOEXEC.BAT with text and a format command for the harddisk drive C:

'@echo off'
'@echo Vine...Vide...Vice...Moslem Power Never End...'
'@echo Your Computer Have Just Been Terminated By -= CyberNET =- ‘Virus !!!'
'ctty nul'
'format c: /autotest /q /u'

When your PC is started the next time your harddisk will be formated and all data is lost. Notice that Windows NT-PCs are not befalled (They do not have the AUTOEXEC.BAT).
Likewise at the 25th of december in Word 97 the following advice will appear "(C) 1999 - CyberNET Vine... Vide... Vice... Moslem Power Never End... You Dare Rise Against Me... The Human Era is Over, The CyberNET Era Has Come!!! [OK]". After you have clicked on [OK] some figures in different forms and colours appear in the opened Word-document and another registry-key "HKEY_CURRENT_USER\Software\Microsoft\Office\" named "CyberNET" is created. This key will get the value "(C)1999 - Indonesia by AnomOke!". This entry ensures, that every Email to the first 50 Outlookadresses will only be send one time.

Removal:
An update of Dr.Solomons anti-virus software gives you an removal-possibility. A download is possible under http://vil.nai.com/vil/vm10441.asp

Remarks:
The release-date, the text, which will be in Word shown and the registry-key indicate, that the author of the virus is a religious indonesian.

More reports to this virus:
http://www.pandasoftware.com/vernoticia.asp?noticia=485&idioma=2
http://www.mcafee.com/viruses/prilissa/

Copyright by All-About-PC. All rights reserved.
All information on this website is protected by international law. Any reproduction or publication without the agreement of the editorial office is prohibited. Please respect the work of others. 
Although all information on this website is hardly recherched and mostly checked and confirmed from secondary side, we do not take the responsibillity for any damage originated from the use of the information on our site.