|
|
HTML.NoWarn. Viruses Information
| Name: |
HTML.NoWarn. |
| Category: |
Viruses |
| Description:
|
Details
HTML.NoWarn.a
This a family of parasitic HTML infectors. They search for HTML files on the local drive and affect them. The original "NoWarn" virus was written by the same person that wrote the HTML.Internal virus and uses the same way to infect HTML files: the infection routine is a script written in Visual Basic, and the header of infected HTML file contains the reference for this script.
The virus activates its infection routine depending on the system random counter with probability 1/6, it then searches for HTM, HTML and HTT files in the current and parent directories and writes itself to the beginning of the file without any damage for the host file data.
The virus uses a trick to hide the ActiveX warning message: it tries to cover it with its own message window that "inform" the user:
Are you sure you want to view the contents of this HTML document?
This trick works correctly only if the Desktop area is set to 800x600 pixels, otherwise the virus message does not cower the ActiveX warning.
There are several virus versions known. After infecting HTML files they write the text to the browser status line:
"NoWarn.a": HTML.NoWarn v0.1 /1nternal
"NoWarn.b": HTML.NoWarn v0.11 /1nternal
"NoWarn.c": HTML.Guess you shouldn't done that!!! /SwedisHit ADOLF |
Top Viruses Visited Pages:
Invader. - 231 visits
not-a-virus:RiskWare.Tool.RegPatch. - 69 visits
Worm.P2P.Harex. - 63 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 55 visits
Small.58. - 55 visits
Coito.64 - 53 visits
I-Worm.Mapson. - 45 visits
Win16.Klon.1177 - 41 visits
Win32.Hidra - 41 visits
Marine.500 - 34 visits
Random Viruses Pages:
Worm.Linux.Chees
Daga.91
Dieg.158
Tina.82
DDoS.Win32.Kozo
Carnage.67
Rawal.137
Backdoor.Win32.Small.f
Macro.Word97.Rome
MSN-Worm.Jitu
|
|
