W95.SchoolGirl.910

Risk Level 1: Very Low

Printer Friendly Page|Rate this page

Discovered:: December 4, 2001
Updated:: February 13, 2007 11:48:01 AM
Type:: Virus

W95.SchoolGirl.910 is a Windows virus that replicates only under Windows 95/98/Me. If it is activated under Windows NT/2000/XP, the virus does nothing but transfer control to the original host program.

This virus infects all .exe, .ocx and .scr files that it finds on all local drives (including mapped drives). Due to the way this virus infects files, it may damage or corrupt self-extracting executables and setup programs (such as InstallShield).

This virus also carries two payloads:

Payload one:
This payload becomes active on the 16th of every month. It simply opens up the home page for the Sichuan University of Science and Technology in China.
Payload two:
This payload is activated only if the year is 2002 or later and only if the day of the month is the 17th. Once activated this payload deletes all executables on all local drives (including mapped drives).

Antivirus Protection Dates

Initial Rapid Release version December 5, 2001
Latest Rapid Release version September 28, 2010 revision 054
Initial Daily Certified version December 5, 2001
Latest Daily Certified version September 28, 2010 revision 036
Initial Weekly Certified release date pending

Click for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Moderate

Damage

Damage Level: Medium

Distribution

Distribution Level: Low

Writeup By: Atli Gudmundsson

Technical Details

Search Threats

Search by name

Example: W32.Beagle.AG@mm

Internet Security Threat Report, Volume 16