Lirva (or Arvil) is a mass-mailing worm that uses several methods to spread.
Besides email the worm uses ICQ and IRC chat networks and Kazaa
file sharing network to spread. It also propagates through shared folders and
Windows network drives. Lirva has functionality to disable several antivirus and
security applications if it notices their presence. If the worm is active in the
system it tries to steal passwords and send them to an external email
address.
E-mails sent by Lirva vary a lot, but they often make references to Avril Lavigne, Canadian rocker who was nominated for five Grammy awards just two days ago. Apparently the virus was written by a Kazakhstan-based fan of the artist. When Lirva worm activates, it tries to open the official web site of Avril Lavigne and starts a graphical screen effect consisting of coloured, moving circles.
Lirva.B
Functionally Lirva.B is very close to the original Lirva virus. It has been modified to evade detection of some anti-virus software. Another difference is that Lirva.B fakes the sender address of infected e-mails, replacing the address of the infected user with the e-mail address of a random innocent bystander. The real e-mail address of the infected user can often be found from the e-mail's "Return-Path" header.
Due to the increasing threat posed by Lirva, Panda Software has made the
PQREMOVE utility available to all users. This application is designed to
repair the possible damage that the virus could inflict on computers and can
be downloaded from;
http://www.pandasoftware.com/download/utilities/
ExploreZip.E
ExploreZip is an internet worm which was first found in June 1999.
The original version (ExploreZip.A) spread all over the globe within days of initial discovery,
becoming first of the really widespread internet worms.
After this, several modified versions of this worm has been found.
On the 8th of January, 2003 - three and half years after the virus was first seen
ExploreZip.E was found.
This version was modified so that it was undetectable to most anti-virus programs. The worm
functionality had stayed the same. All of the ExploreZip variants spread as an
e-mail attachment and activate by destroying Microsoft Office documents and
source code files from infected computers and from local networks. The worm
modifies an infected computer so that the worm will reply to unread e-mails,
sending dummy e-mail replies with an infected
attachment.
Sobig
Sobig is an e-mail and network worm, sending itself around as a PIF e-mail attachment.
The worm has remote control functionality through which the virus writer can control infected computers.
Detailed technical descriptions of these worms as well as a screenshot
of the Lirva virus activation circle routine are available in the F-Secure Virus Description database at http://www.f-secure.com/v-descs/
F-Secure Anti-Virus can detect and stop all the mentioned viruses.
More Information;
Symantec Security Response has upgraded the W32.Lirva.A@mm threat from a Category 2 to a Category 3 as of
January 9, 2003.
http://securityresponse.symantec.com/avcenter/venc/data/w32.lirva.a@mm.html>
Win32.Lirva.A and Win32.ExploreZip.91048 Worms
http://support.ca.com/techbases/ilnt/virusalert2.html
More information about W32/Avril-A can be found at:
http://www.sophos.com/virusinfo/analyses/w32avrila.html
More Information about W32/ExploreZi-N can be found at
http://www.sophos.com/virusinfo/analyses/w32explorezin.html
What is Worm/ExplorerZip.E
http://support.centralcommand.com/cgi-bin/command.cfg/php/enduser/std_adp.php?p_refno=030108-000016
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
See my Anti-Virus pages
A Technical Support Alliance Charter Member
12/01/2003