( ! ) Notice: Undefined variable: p in /app/domains/com/druid628/www/public_html/techtips/virus/header.php on line 5
Call Stack
#TimeMemoryFunctionLocation
10.0110231520{main}( )../avril.php:0
20.0113238504include( '/app/domains/com/druid628/www/public_html/techtips/virus/header.php' )../avril.php:5
<br /> <font size='1'><table class='xdebug-error xe-notice' dir='ltr' border='1' cellspacing='0' cellpadding='1'> <tr><th align='left' bgcolor='#f57900' colspan="5"><span style='background-color: #cc0000; color: #fce94f; font-size: x-large;'>( ! )</span> Notice: Undefined variable: subtopic in /app/domains/com/druid628/www/public_html/techtips/virus/header.php on line <i>15</i></th></tr> <tr><th align='left' bgcolor='#e9b96e' colspan='5'>Call Stack</th></tr> <tr><th align='center' bgcolor='#eeeeec'>#</th><th align='left' bgcolor='#eeeeec'>Time</th><th align='left' bgcolor='#eeeeec'>Memory</th><th align='left' bgcolor='#eeeeec'>Function</th><th align='left' bgcolor='#eeeeec'>Location</th></tr> <tr><td bgcolor='#eeeeec' align='center'>1</td><td bgcolor='#eeeeec' align='center'>0.0110</td><td bgcolor='#eeeeec' align='right'>231520</td><td bgcolor='#eeeeec'>{main}( )</td><td title='/app/domains/com/druid628/www/public_html/techtips/virus/avril.php' bgcolor='#eeeeec'>../avril.php<b>:</b>0</td></tr> <tr><td bgcolor='#eeeeec' align='center'>2</td><td bgcolor='#eeeeec' align='center'>0.0113</td><td bgcolor='#eeeeec' align='right'>238504</td><td bgcolor='#eeeeec'>include( <font color='#00bb00'>'/app/domains/com/druid628/www/public_html/techtips/virus/header.php'</font> )</td><td title='/app/domains/com/druid628/www/public_html/techtips/virus/avril.php' bgcolor='#eeeeec'>../avril.php<b>:</b>5</td></tr> </table></font> Druid628 :: Virus :: Lirva (Avril) Virus
DruiD628 :: Tech Tips ::
( ! ) Notice: Undefined variable: subtopic in /app/domains/com/druid628/www/public_html/techtips/virus/header.php on line 38
Call Stack
#TimeMemoryFunctionLocation
10.0110231520{main}( )../avril.php:0
20.0113238504include( '/app/domains/com/druid628/www/public_html/techtips/virus/header.php' )../avril.php:5
Virus ::
Lirva (Avril) Virus  


( ! ) Notice: Undefined variable: PHP_SELF in /app/domains/com/druid628/www/public_html/techtips/virus/header.php on line 55

Call Stack
#TimeMemoryFunctionLocation
10.0110231520{main}( )../avril.php:0
20.0113238504include( '/app/domains/com/druid628/www/public_html/techtips/virus/header.php' )../avril.php:5
','500','500');" onMouseDown="javascript:window.status=' ';return true;" onMouseOver="javascript:window.status='';return true;" onMouseUp="javascript:window.status='';return true;" onMouseOut="javascript:window.status='';return true;"> Email this to a friend
There is a new celebrity tribute virus roaming the internet.
The Lirva virus named after the new Canadian born anti-pop star, Avril Lavigne, is a reoccurring time-bomb virus. This virus will activate on the 7th, 11th, and 24th every month. Upon the awakening of the virus, it will search your computer for valid email address and will replicate itself out to these email addresses. It will also launch your default web-browser and turn it to the Avril Lavigne website and display an animation on your desktop. Any firewall and anti-virus software you have running is also not safe, the virus will attempt to terminate this software with extreme prejudice.  The most important things to know about is, if you are Windows 95, 98 or Me the virus will send any stored passwords the the author of the virus and it will begin to replicate itself through any open shares on your network and any P2P (Peer-2-Peer) shared folders. 
How it is spread:
This virus like many of its predecessors is replicated through email however, this virus is doing things a little different. This virus started in the P2P community and is still living there.  It is also is infecting ICQ and IRC.

Subject and Message Lines:
If you receive this virus through email it will be delivered with a random subject line, message and attachment name, so be cautious of any suspicious email. The subject of these emails will appear to be a forward or a reply. If you receive any email you are unsure about please contact that person before opening the email. The most common email subjects and messages the virus uses are in relation to:

  • Avril Lavigne
  • Admission procedure
  • Microsoft Security Bulletins

Attachment Names:
The attachments will also be a randomly generated name most likely relating again to the previously mentioned subjects. The following is a list of examples you might see (please remember these are not the only names of the attachments, they may be in any variation of these):

  • MSO-Patch-0071.exe
  • Resume.exe
  • Download.exe
  • Transcripts.exe
  • Readme.exe
  • AvrilLavigne.exe
  • Complicated.exe
  • IAmWithYou.exe
  • Sk8erBoi.exe
  • Cogito_Ergo_Sum.exe
  • CERT-Vuln-Info.exe
Technicalities:
On special days of the month (7,11,24) you web browser will take you to www.Avril-Lavign.com

Creates a registry entry named "Avril Lavigne - Muse" in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
As well as
HKEY_LOCAL_MACHINE\Software\OvG\Avril Lavigne
There can also be a Unusual named file in your Recycle Bin that will be a randomly named.
Your Autoexec.bat file will have a new entry that will say
@win
randomfilename.exe

2000-2018 DruiD628
micah {at symbol} druid628.com

Home | Links | Geekdom | About Me | Code | Tablet (Blog)
Tech Tips | Virus