Trojan.Billrus.Texto

This is a memory-resident Trojan horse. It has an icon that makes it look like an ordinary text file. Every 10 minutes, it checks for a disk in drive A. If it finds one, it deletes as many files as is necessary to ensure enough space on the disk to copy both itself and another necessary, larger file to the disk.

The Trojan deletes the following files, and replaces them with copies of itself: Attrib.exe, Edit.com, Format.com, Deltree.exe, Ed.cab, Mscdex.exe, Appwiz.cpl, Attrib.com, and Deltree.com.

The Trojan can also change its file name to one of 18 different names, such as Readme.exe, Texto.exe, and so on. The first time that it is run, it starts Notepad and displays the email address of the Trojan author. The Trojan adds a value to the registry so that it is run when Windows starts. The 30th time that the Trojan is activated, it deletes all files on the drive C, and displays a message box titled Uruguay that contains the text Billrus.