W95/Creative.A@MM Worm Information

Name: W95/Creative.A@MM
Aliases: Shockwave, W32/Prolin@mm, Troj_Shockwave.A, Troj_Prolin.A
Type: Internet worm

Description:

W95/Creative is a worm that that arrives as an email with an attachment named CREATIVE.EXE. The subject line will be: "A great Shockwave flash movie", and the body of the message is "Check out this new flash movie that I downloaded just now � It's Great, Bye". When executed, Creative will send itself to all email addresses listed in Microsoft Outlook. It also sends a second email to the email address "[email protected]", possibly the creator of the virus, that has the subject line: "Job Complete" and the message: "Got yet another idiot".

The worm will then move all files with the extensions ZIP, MP3, and JPG onto the C drive, where it will add the following to the extension: "change at least now to LINUX" (for example, "products.ZIP" would become "products.ZIPchange at least now to LINUX").

When the worm infects a system, it installs itself in the following two places:

C:\Windows\Start Menu\Programs\StartUp\creative.exe

The copy in the StartUp folder will be launched every time Windows is started.


Detection:

Command AntiVirus version 4.58.3 or higher with definition files dated 12/1/2000 or later detects the worm.

NOTE: If you are already a Command customer we recommend that you update to the current version (full build 4.59.6 or higher) immediately (Note: This upgrade only affects Windows 9x, Windows NT and Windows 2000 versions):

Current customers

to download

IMPORTANT: The Definition Files (dated 12/01/00) that provide the information needed to detect this virus can be updated by clicking here.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Home � Purchase Center � Virus Center � Support Center