W32/Trilissa.D worm

Subscribe to Virus Alert
Mailing List

Enter your Email
(Ex : john@company.com)

W32/Trilissa.D Worm

Information about the W32/Trilissa.D worm:

W32/Trilissa.D is an email worm. This worm will infect Windows systems.

It arrives with the following subject:

Bush is a criminal!

The body of the mail contains:

Bush is a criminal!!!! See this screensaver!! HE IS A BASTARD!!!

This mail contains an attachment Bush_you_are_guilty!!!.scr.

Upon execution of infected attachment, it copies itself as a Bush_you_are_guilty!!!.scr and $$-%1@.EXE with hidden attribute at the root of Windows installed drive. The worm searches for .EXE, .SCR files under Windows and Windows System folders. When found, the worm overwrites the original content of the file by its own code. The backup of original file will be kept as same filename without any extension. It drops a file called MERKAVA.VBS in the root of infected file executed drive and on to a: drive, if floppy is present.

The worm makes changes to the following registry entries to load itself at next system startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

The worm displays a set of messages as shown below:

After displaying all the above message boxes, the worm searches for system and library files to overwrite with worm code similar to above mentioned procedure for .EXE, .SCR files.

This worm first appeared on 9th June 2002.

Other names of W32/Trilissa.D worm:

This worm is also known as I-Worm.Trilissa.D, Worm_Trilissa.D.

Removing W32/Trilissa.D worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.

Download the FREE Evaluation copy of Protector Plus antivirus software

About Protector Plus Antivirus Software Packages:

Proland Software is the developer of Protector Plus range of antivirus software packages. Protector Plus is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

New:
SpamChoke Antispam Software
Download Now!

Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove W32/Trilissa.D worm reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

Click here to order
Protector Plus Antivirus software