Macro Virus Table - Defense Technical Information Center

PC
WEED - v1.0
VARIANT:HLLP.5850
MS-DOS/PC-DOS Computer Viruses
This is a minor variant of the HLLP.3263 (Weed) virus. This version displays a starfield on the
screen.
HLLP.5850 displays this text:
I need milk. My flakes toas
Name: Hooter
Aliases: Hooter, Hooter.4676, HLLP.4676, HLLP.Hooter Type: Program.
Disk Location: EXE application.
COM application.
Features: Deletes or moves files.
Damage: Deletes or moves
files.
Size: 4676 See Also:
Notes: While searching for files to infect, the virus deletes files that match the filters: chklst.* and
anti-vir.dat
The virus creates a file named HOOTERS.EXE when decrypting itself. It deletes this file before
ending.
It triggers if it can not find any files to infect. Depending on the clock, it may display the following
message:
"Hooters, hooters, yum, yum, yum. Hooters, hooters, on a girl that’s dumb. - Al Bundy."
Infected files, including Windows files, appear as DOS executables after infection and are run as
DOS applications.
Infected files also contain the following text: "Wow - you’ve found the hidden message (like it’s
hard!) Made in Auckland, New Zealand, in 1996. Contains the greatest saying of all time.
Dedicated to the few truly great pairs of luscious hooters."
See the Virus Bulletin 1/97 for an analysis.
Name: Horror
Aliases: Horror Type: Program.
Encrypted/Stealth The virus
actively hides.
Disk Location: COM application.
Features: Unknown, not analyzed yet.
EXE application.
Damage: Unknown, not
analyzed yet.
Notes:
Size: 1112
1137
1182
See Also:
210 CIAC Computer Virus Information Update May 21, 1998