recursal/Fanatic-Fandom huggingface dataset:
Spellsword

**Spellsword** is the multiclass option when you get both level 5 in Apprentice and level 5 in Warrior.

The Spellsword gets a +1 to Combat interaction at level 1. They get a +1 to Social interaction at level 6. They get a +1 to encounters with Dragon mobs at level 3, that bonus increase to +2 at level 8. They get a +1 to encounters with Elemental mobs at level 4. They get a +1 to encounters with Unique mobs at level 7. And finally, they get a +1 to encounters with Arcane mobs at level 9.
LockBit

ransom note/wallpaper

**LockBit** is an encrypting ransomware, it encrypts files with the .lockbit extension. This ransomware also threatens to publish the victim's files if they don't pay. It is a ransomware-as-a-service; and run by a gang also called LockBit.

## Payloads

LockBit spreads using phishing emails and security exploits.

It creates a group policy to disable Windows Defender. LockBit then encrypts the user's files with the .lockbit extension. It then changes the desktop wallpaper to a ransom note, and threatens to publish the user's data if they don't pay.

## Locker\_Apple\_M1\_64.

In 2023 a build called “locker\_Apple\_M1\_64.” was discovered that seemingly targets macOS. However, it was likely a test build. The strings have multiple references to VMware ESXi, despite it not supporting the processors used in most modern macs. The encryptor has a list of 65 file extensions names to not encrypt, which are all Windows file extensions and folders; including:

```
.exe
.bat
.dll
msstyles
gadget
winmd
ntldr
ntuser.dat.log
bootsect.bak
autorun.inf
thumbs.db
iconcache.db

```

And when launched, the build can't actually encrypt files on the machine.

## Trivia

* It used to be called ABCD, and encrypted files with the .abcd extension
* This malware also affects Linux
* It was first discovered in 2019
* LockBit uses the salsa20 encryption algorithm
* Most of their attacks are targeted

## Citations

1. ↑ https://twitter.com/patrickwardle/status/1647662008278609923
Cryptolocker

**CryptoLocker** is a ransomware trojan horse that is spread via email. The .exe file for CryptoLocker arrives in a ZIP file attached to an email message contains an executable file with the filename and the icon disguised as a PDF, taking advantage of Windows' default behaviour of hiding the extension from file names to disguise the .exe file extension for the program. CryptoLocker's payload encrypts the victim's files using a method of encryption that is extremely hard to crack (RSA-2048), and refuses to unlock the files until the ransom of 500 units of currency ($500, €500, £500, etc.) is paid. However, people who have paid the ransom have not had their files decrypted yet. It gives about 72 hours for the ransom to be paid, and if this is not done, then the program deletes the decryption code (preventing any recovery of data). The virus was last updated the 20th of November 2013 and isn't as notorious as previous versions.

## Aliases

* Trojan.Ransomlock (Symantec)
* Ransom.C (AVG)
* Trojan-Ransom.Win32.PornoBlocker.cel (NictaTech Free Web Scanner)
* Ransom.Worm.Cryptlocker.a (Kaspersky)

## Sources

BBC News

http://www.bbc.co.uk/news/technology-24964426

Wikipedia

https://en.wikipedia.org/wiki/CryptoLocker
CIH

**CIH** (also known as Chernobyl) is a computer virus that was created in 1998. It infects Windows 95, 98, and ME.

## Payloads

CIH infects every running executable after an infected file is opened. Unlike most other viruses, it looks for gaps in the program's code and writes it's code there, instead of writing the code to the end of the file. This helps CIH avoid being detected by antiviruses.

On April 26 of any year, 2 payloads will be activated. The first one overwrites the MBR (Master Boot Record), partition table, and file allocation table, which may cause the machine to hang or bluescreen. The second payload will try to overwrite the computer's BIOS, and on a compatible system will render the computer unbootable/brick it until the BIOS chip is reprogrammed or replaced.

## Trivia

This virus is also known as "chernobyl" because the virus's payload date (April 26) happens to be the anniversary of the chernobyl nuclear disaster.
Live Protection Suite 2019/Antivirus 10

LPS window

**Live Protection Suite 2019** is a rogue antivirus program, it pretends to detect malware and tries to make the user pay for the "full version" to "remove" it.

## Payloads

Live Protection Suite pretends to scan the user's computer, however, to remove any "detected threats", the user is told to pay. This rogue will show several popups and notifications, claiming that the computer is infected, it also opens dubious webpages.
Smart Defragmenter

Window

**Smart Defragmenter** is a fake defragmenter. It pretends to detect drive errors but won't actually "fix" them until the user pays for the program. It can't be uninstalled unless the user has activated the program.

## Payloads

Smart Defragmenter will pretend to scan the drive, it then "detects" errors. It says that the computer has to go into safe mode. However, when the user "boots into safe mode" to fix the drive "errors", the program demands the user to buy it. Smart Defragmenter also shows several notifications, all claiming that there are problems with the user's drive. After a while, it will block every program from opening, showing an error message instead.

The "Smart Defragmenter" folder has an uninstaller that doesn't work.

## Gallery

Notification #1Notification #2"Uninstaller"The error that pops up when the user tries to uninstall itMessage that pops up when user tries to run a program
Intuitive

Major Bonus
 Minor Bonus

**Intuitive** is the starting path for the Sorcerer and Psionicist, eventually leading up to the Ascendant Sorcerer and Psionic Master respectively. It also opens up the multiclass options of: Psychic Warrior, Cerebromancer, Shadowmind, Prophet, Mindbender, and Wildmage.

The Intuitive gets a +1 to Social interaction at level 2, and a +1 to Encounters with Fiends at level 4.
38zu

38zu.cn contains malware. Your computer may become infected with a virus if you visit this site. Google has found malicious software that may be installed on your computer if you continue. If you have visited this site before or trust it, it is possible that it was recently compromised by an attacker. You must not proceed. Please try again tomorrow or go to another site. We have already informed 38zu.cn that we found malware on the site. To learn more about issues found on 38zu.cn, visit the Safe Browsing Diagnostics Page. Of google. Helps improve malware detection by sending additional data to Google about websites where you see this warning. This data will be analyzed in accordance with the Safe Browsing Privacy Policy.
RETARDIVIAN

video File:Placeholder
Write the first paragraph of your page here.

## RETARDIVIANS HISTORY

RETARDIVIAN was born with severe autism, als, aand adhd
he was hit in the head hard as a baby, and his dad often raped him

## Coming to OT

, he was put in a garbage can where lumass found him, and showed him OT, .
he often likes watching old staff an insulting new stuff
Flashback

**Flashback**, also known as **FakeFlash**, is a trojan horse affecting computers running macOS. The first variant was discovered in September 2011.

## Details

It's original variant tricked user into installing it by pretending to be a flash installer. A later variant used a Java vulnerability to start a drive-by download, which would install the malware and begin stealing personal information. Other users on the computer would not be infected unless their accounts were infected separately. As of January 9, 2014, 22,000 macs were still infected.
DBase

Creator
 Place of Origin
 Source Language
 File Type(s)
 Aliases
 Reported costs

**DBase** is a virus that corrupts database files created by the legitimate dBase program.

## Behavior

When DBase is executed, it checks if it is already in memory, and if not, becomes resident. It infects .com and .ovl files.

When a .dbf file (the main file format of the dBase database management system) is written to while the virus is in memory, the information sent to the file will be garbled. When the file is loaded, the virus will show the file as if it were normal. If the virus is removed after the files have been garbled, they will be permenantly garbled. It may do this to other files whose name ends in .dbf, regardless of whether or not they belong to the dBase program.

The virus creates a file named bugs.dat in any directory where .dbf files are stored. This file keeps track of what files were corrupted and what they were corrupted with. When this file has not been written to for 90 days, the virus overwrites the file allocation table and root directory of drives D: to Z:. This section of the virus's code is buggy, and may not

In addition to the damage to .dbf files, programs larger than 63,415 bytes will no longer be loadable.

## Name

DBase gets its name from the dBase database management program, as it corrupts the .dbf files this program uses as its default file format. This is in violation of the CARO naming scheme, which prohibits the use of a legitimate product's name for the name of a virus, but this virus predates the CARO naming scheme. Nearly all antivirus products use the name DBase as the detection name in their products, the only differences being with regard to capitalising the letters "D" and "B" in the name.

## Sources

Thomas Lippke, University of Hamburg, Virus Test Center. Reports collected and collated by PC-Virus Index, "dBase" Virus. 1990.02.15

Trend Micro, DBASE.

F-Secure Antivirus, dBASE.

Fridrik Skulason. VIRUS-L Digest, Volume 2 : Issue 234. 1989.11.07

McAfee Antivirus, dBASE.
Operating System

An ***Operating System (OS)*** is an interface between hardware and user which is responsible for the management and coordination of activities and the sharing of the resources of the computer that acts as a host for computing applications run on the machine. As a host, one of the purposes of an operating system is to handle the details of the operation of the hardware. This relieves application programs from having to manage these details and makes it easier to write applications. Almost all computers (including handheld computers, desktop computers, supercomputers, video game consoles) as well as some robots, domestic appliances (dishwashers, washing machines), and portable media players use an operating system of some type. Some of the oldest models may, however, use an embedded operating system that may be contained on a compact disk or other data storage device.

Operating systems offer a number of services to application programs and users. Applications access these services through application programming interfaces (APIs) or system calls. By invoking these interfaces, the application can request a service from the operating system, pass parameters, and receive the results of the operation. Users may also interact with the operating system with some kind of software user interface (SUI) like typing commands by using command line interface (CLI) or using a graphical user interface (GUI, commonly pronounced “gooey”). For hand-held and desktop computers, the user interface is generally considered part of the operating system. On large multi-user systems like Unix and Unix-like systems, the user interface is generally implemented as an application program that runs outside the operating system. (Whether the user interface should be included as part of the operating system is a point of contention.)

Common contemporary operating systems include BSD, Darwin (Mac OS X), Linux, SunOS (Solaris/OpenSolaris), and Windows NT (XP/Vista/7/8/8.1/10/11) . While servers generally run Unix or some Unix-like operating system, embedded system markets are split amongst several operating systems., although the Microsoft Windows line of operating systems has almost 90% of the client PC market.
Fantom

**Fantom** is an encrypting ransomware, it disguises itself as a Windows update and encrypts the user's files with the *.fantom* extension.

## Payloads

When run, Fantom will run an embedded program called WindowsUpdate.exe that displays a fake update screen which goes on top of all other open windows and does not allow you to switch to any other applications.

    Though the user can exit the fake update by pressing Alt+F4, this will not stop the encryption process.

This ransomware also changes the wallpaper and creates an HTML document telling the user that their files have been encrypted.
Builder

**NOTE: Developing malware that is not for educational and/or research purposes is illegal and can result in legal consequences, including being ARRESTED. This page is for informational purposes only. Do not use this information to develop malicious programs.**

A builder, also known as a virus creator is a application that develops malicious applications. An example of an builder is JPS Virus Maker.
Brother

Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Infection Length

**Brother** was a memory-resident encrypted infecter of MS-DOS .COM files, including COMMAND.COM. It appeared in issue 1 of VLAD magazine released in July of 1994.

## Behavior

Brother goes resident by reducing the size field of the MCB of the host file if it is the last MCB and moving itself to the now unallocated space. Once INT 21h is hooked, .COM files are infected on Execute, Extended Open, Chmod and Rename calls. Files are marked as infected by setting the 'seconds' field of the time-stamp to 62.

Like other members of the 'Incest' family, Brother checks for file extension but only handles upper-case Brother also attempts to delete Central Point Anti-Virus and Microsoft Anti-Virus checksum databases ("chklist.cps" and "chklist.ms").

## Sources

Original research by JPanic aka @JPanicVX
Koteyka

**Koteyka** (**Котейка**, meaning "kitty") is a joke virus made by Endermanch (video link) in 2017 November 1 and then archived 2023 June 26. If you close a Koteyka window, it will clone itself, kind of like Hydra. When you move the slider to the end, it would show "Бесплатное УВЕЛИЧЕНЕ ЧЛЕНА ЭА 10 ДНЕЙ!!" (free dick enlargement for 10 days)
Sample Page

This page is an example page, this is how you format a page.

```
For more editing guidelines see This Page.

```

## Sample Page for Malware

This guide is for Source Editing Only

Hint: To introduce a new section, type == before the title.

```
For example "==Example==" (Source Mode Only)

```

Hint: Most of MalwareInfobox fields are self explanatory, if you are not sure of any field do not fill it in!

Formatting:

 Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Aliases
 Family
 File Size
 Infection length
 Reported costs

```
**<Malware Full Name>** or **<Malware Common Name>** is a <type> that <details>.

```

```
==Details==
<Malware Common Name> <Full Details>

```

```
==Aliases==
<Aliases from Antivirus Database>

```

```
==Videos==

```

```
==Sources==
<Website Name>, [<Website Link> <Website Link Name>]

```

Example Preview:

 Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Aliases
 Family
 File Size
 Infection length
 Reported costs

**HTML.Malware** or **Malware** [*Hint: Start with both technical name and common name, and put bold on both*] is a self-replicating worm that spreads through retrievable domain names. It is part of the Malware Wiki family.

[*Hint: To do an internal link, put double brackets around the page name. For example CIH]*

[*Hint: Start with a brief introduction of the virus, but do not spoil the payload*]

### Payload

*Hint: To introduce a sub-section, type three = signs instead of two. To make a sub-section of that add four and so on...*

When run, the file will look in the computer's Hard Drive for .doc and .docx files and attach a macro to them, which will delete them upon opening.

### Spreading Routine

*Hint: To add a gray field, simply leave a space at the beginning of the line on Source mode*

The virus will spread itself through MS Outlook and retrievable domains.

```
Subject: Check this out!
Message Body: Check out this epic Flash game, you'll love it!
Attachment: Ex1.html

```

### Sources

```
*Hint: To introduce external links, type a single bracket, followed by the URL and then the display text.*
**For example:** Google will appear as Google. Try to avoid using bit.ly links, please use tinyurl with a PREVIEW link. Otherwise, it will be deleted on sight.

```

YouTube

If you have any questions, feel free to contact our admins. We hope this helps you.

## Sample Page for Virus Authors

```
Coming Soon!

```
ColorBug

Creator
 Date Discovered
 Place of Origin
 Source Language
 File Type(s)
 Aliases
 Family

**Trojan.Win32.ColorBug**or **ColorBug** is a virus that runs on Win32 Operating Systems.

## Payload

ColorBug appears as an average executable, but the user will notice the .EXE file lacks an icon. When run, nothing will happen until the user reboots the system. They will soon realize the color palette has changed [colors are random]. However, the virus fails to lock display settings, so the user can quickly change the color scheme back to default.

It's not a very destructive virus but can be pretty annoying.
Oompa Loompa

**Oompa Loompa**, also known as **Leap** was a worm and virus discovered in February 2006. It was the first major macOS malware.

## How it spreads

Oompa Loompa spreads over LAN only using the bonjour protocol. The user gets a file called latestpics.tgz from someone in their iChat bonjour list.

## Payloads

The latestpics.tgz file claimed to be screenshots of Mac OS X Leopard, but when the user opened the "image", a terminal window opens. It also wants to user to give it admin privileges. Oompa Loompa then sends itself to everyone in the user's iChat bonjour list. It then infects the 4 most recently used applications written in Cocoa; but it only infects apps owned by the user, so any apps owned by the system are unaffected, such as ones that came preinstalled. It only infects apps when an infected app is launched.

## Trivia

* Ooompa Loompa infects apps by adding extended attributes; with the name "Oompa", and the value "Loompa". This is where the worm gets its name from
Al'Dor

Al'Dor is the world upon which our story takes place.

   The raddest fucking world you will ever experience that is.

Prepare yourself as you dive into the world that is Al'Dor and learn of the great history that surrounds it.

<iframe width="1280" height="720" src="http://maps.wikia-services.com/api/v1/render/13432?uselang=en" frameborder="0">Map</iframe>
GandCrab

GandCrab Ransomware

**GandCrab** ransomware is a type of malware that encrypts a victim's files and demands ransom payment in order to regain access to their data. GandCrab targets consumers and businesses with PCs running Microsoft Windows.

### Short bio

Ransom.GandCrab is Malwarebytes’ detection name for a family of ransomware that encrypts important files and asks for a ransom to decrypt them. There are several versions of Ransom.GandCrab as the threat actors keep working on it. They all target Windows systems.

### Symptoms

The first thing users of affected systems notice is usually the ransom note when the encryption has already finished.

### Type and source of infection

Ransom.GandCrab scans the infected system and any network shares for files to encrypt. You can recognize the version of GandCrab by looking at the extensions the encrypted files have:

* Version 1 gives the .gdcb extension
* Versions 2 and 3 give the .crab extension
* Version 4 gives the .krab extension
* Version 5 gives a randomized 5 letter extension

Ransom.GandCrab is spread in many different ways:

* malspam
* exploit kits
* social engineering
* fake cracked software sites

### Aftermath

For some versions of Ransom.GandCrab there are free decryption tools. You can check the NoMoreRansom! for which ones they are currently available.
Jigsaw

ransom note

**Jigsaw** is an encrypting ransomware created in 2016. It was initially titled "BitcoinBlackmailer" but later became known as Jigsaw. It encrypts the user's files with the .fun extension, and gradually deletes them unless a ransom of $150 is paid.

## Payloads

After it starts, the ransomware adds a file called "drpbx.exe" to the AppData folder and tries to launch it; it then shows a message to distract the user while it encrypts the files. After the encryption process completes, it displays a ransom note: which includes a countdown for an hour, which will delete 1 file after it reaches 0, this repeats every hour and the number of files that will get deleted increases; and a button which lists all the encrypted files. Jigsaw also adds a startup item claiming to be either Firefox or Dropbox.

## Trivia

One variant of this ransomware includes the lines "I want to play a game with you. Let me explain the rules:" at the beginning, and "Now, let's start and enjoy our little game together!" at the end.
Aphornon

Aphornon is a black metal group from Florida. The project has been on a hiatus for a number of years, but is still known to be an active group. Some members have other musical projects as well.

## Band Members

* **Current Lineup/Last Known Lineup:**

 Angus | Session Drums

## External Links

* Aphornon@MySpace.com
* Aphornon@Metal-Archives.com
Animal

**Animal** is an early self-repeating program from 1975. Its primary purpose was to distribute a "20 Questions" game in which the user gives the program clues as to what animal they are thinking of and the program guesses it. Though it is predated by Creeper, Reaper and some Rabbit programs, the Animal program is the earliest self-replicator whose existence can be confirmed.

## Bahaviour

When Animal is executed, it asks twenty questions for clues and tries to guess an animal that the user is thinking of. Animal calls the "Pervade" subroutine, which finds the directories that the current user has access to. If the directory does not contain an up-to-date version of Animal, it will copy itself to that directory. It will overwrite any older version of Animal, but will take special care to not delete any other programs.

## Effects

Animal's creator, John Walker let the program loose in San Francisco, and after around a week it was in Washington DC. Univac's development center in Roseville Minnesota had an Animal infection, and some Univac users claimed that they had received infected software distribution tapes. The program spread for about a year, until an update for the Exec 8 operating system was released, which changed the system tables that the Pervade subroutine checks.

It is unlikely that Animal ever caused any measurable damage. The program contained no deliberately malicious code and did not even exploit any system vulnerabilities. It even took special care to not affect any of the user's programs.

## Origin

John Walker's original Animal program was coded in 1974 April, but the Pervade routine that gave the program its self-replication ability was introduced to the program in 1975 January. Walker observed many years later that the program would be considered a malicious program, but at the time he saw it as a good idea.

## Legend to History

The story of the Animal program gained the status of an urban legend. One variation of the legend tells of a program named "Hunter" that was used to destroy Animal. Another version, described by John Walker as "garbled", appeared in Scientific American in 1985 in March (the articles can be found in the book "The Armchair Universe" by A.K. Dewdney), prompting Walker to write a letter to Scientific American to explain what really happened.

Because Walker came forward with the story, Animal is the first self-replicating program whose existence we can be completely certain of, as its source codes can be found online. Creeper, Reaper and Rabbit are still semi-legendary, as no creator has come forward and no source codes or binaries of these programs can be found.
ALC

ransom note

**ALC** is a scareware discovered in March 2023. It blocks the screen and shows a ransom note. The note claims that the user's files have been encrypted, but ALC actually doesn't encrypt anything.

## Payloads

When executed, just before blocking the user's screen, ALC creates several files on the desktop. One of the files, "RUS!.txt" has terrible English and says it targets "russia and its counterparts"

ALC then blocks the screen and shows a fullscreen note claiming to have encrypted the user's files, and it demands $2000 to "decrypt" them.

## Trivia

* The ransom note also has bad English
* ALC can be considered a screen-locking ransomware
* It disables Task Manager
Pikachu

NOTE: This is not my article! I have transferred it from Wikipedia! Original link here!

The **Pikachu virus**, sometimes referred to as **Poké Virus** (not to be confused with Pokérus in actual Pokémon games), was a computer worm believed to be the first malware geared at children due to its incorporation of Pikachu from *Pokémon*.

It was released on June 28, 2000, and arrived in the form of an email titled "Pikachu Pokemon" [*sic*] with the body of the e-mail containing the text "Pikachu is your friend." Opening the attached executable shows users an image of Pikachu, along with a message stating: "Between millions of people around the world I found you. Don’t forget to remember this day every time MY FRIEND!" The worm itself appeared in the attachment to the email as a file named "`PikachuPokemon.exe`".

It was often compared to the Love Bug, though the Pikachu worm was noted to be far less dangerous and slower in its dissemination.

## Spread

The worm was mainly spread through Microsoft Outlook email attachments. The email containing the attached worm-program propagated through infected users by sending itself to all contacts in the user's Outlook address book. The website in the body of the email lead to a near-clone of the official Pokémon.com website. *It may be possible that* this website downloaded a Trojan in the background if visited or was a phishing website and this may have assisted in the spread of the virus.

## Execution

When the user clicks on the attachment, `PikachuPokemon.exe` adds the lines "`del C:\WINDOWS`" and "`del C:\WINDOWS\system32`" to the file "`autoexec.bat`". These commands would be executed at the next boot, in an attempt to delete two critical directories of the Windows operating system. However, users would be given a prompt asking whether or not they wanted to delete those folders, since the author did not write the added lines as “`del C:\WINDOWS\*.* /y`” and “`del C:\WINDOWS\SYSTEM\*.* /y`” (the /y switches would have automatically chosen the yes option). This defect was the reason that the Pikachu worm did not cause more damage to computer systems.

P,S. I cannot add the email image cuz I am a Guest User. Thank you for reading this page! ENJOY!
TrytheDoorSonic

TrytheDoorSonic.exe is a malware, created by sohiel shahrab. It plays bytebeat and displays gdi effects, like falling screen, RGBQUAD, GradientFill with BitBlt and AlphaBlend with BitBlt. Sohiel's youtube is: https://m.youtube.com/@user-tu2co3bu4h

Video about it:

https://www.youtube.com/watch?v=4NEoZTs6C5Q&t=375s
Malwarebytes Anti-Malware

**Malwarebytes' Anti-Malware** (**MBAM**) is Malwarebytes' flagship product. It is available in both a free and a paid edition. It is designed to remove malware that other antivirus software have difficulties removing. Both the free and paid-for edition can remove/disinfect trojans, rogue software, browser hijackers, spyware/adware and other malware components. The paid-for version adds real-time protection against malware as well as scheduled scans and updates.

Updates are handled through the online databases MalwareNET™ and RogueNET™. Users can upload infected files of malware to their database, UploadNET™.

## Version 2.0

On March 24th 2014, a revamped version of MBAM was released, dubbed MalwareBytes 2.0. Individuals with a lifetime license could upgrade to this new version for free. This revision of MBAM included numerous security improvements, as well as an updated GUI. They integrated the separate product MalwareBytes Anti-Rootkit into the scanner.

For Premium users, a Malware-Bytes Chameleon is integrated into the software, available through advanced settings. The MBAM team also made numerous improvements to Website Protection and compatibility with older Windows systems.
Protogent

Protegent is an infamous malware, dating back to 2007, which tricks the user by promoting a complete antivirus with the ability to save your data and recover it after the attack of a ramsomware.

The antivirus supposedly detects almost any program or file as malicious, deleting files that are not malware. Also, it has some more programs such as: Activity Reporter, Port Locker & Data Leakage Prevention, Laptop Tracking, Data Encryption, Crash Proof & SysBoost.
ENCODED Ransomware

Ransom note

**ENCODED** is a Ransomware that encrypts data, appends the ".ENCODED" extension to filenames, drops the "HOW TO DECRYPT FILES.txt" file, and changes the desktop wallpaper.

ENCODED's desktop wallpaper and text file contain ransom notes. An example of how ENCODED renames files: it changes "1.jpg" to "1.jpg.ENCODED", "2.png" to "2.png.ENCODED", and so forth.

ENCODED's ransom notes state that files are encrypted using the RSA-1024 algorithm and cannot be decrypted without paying a ransom. The "HOW TO DECRYPT FILES.txt" file provides payment and contact information. It says that victims must pay $120 for data decryption. Further payment instructions will be provided after emailing datafinder@fastmail.fm.

The ransom note in the "HOW TO DECRYPT FILES.txt" file also mentions that all encrypted files will be deleted after a certain number of days of no payment - restoring them will no longer be possible.
YouAreAnIdiot

**This article is about **YouAreAnIdiot**, you may be looking for You Are An Idiot 2.**

### Type

Trojan

**YouAreAnIdiot** was a trojan horse in 2009-2012. When the user goes on the website, the trojan would show text saying "you are an idiot" with 3 smiley faces, and the browser window would bounce around the screen. If the user tries to close the browser, it makes 6 more smaller windows which also bounce around the screen. Hitting Alt+F4 shows text saying "You are an idiot!". This trojan uses up all of the system resources, causing the computer to freeze.

YouAreAnIdiot can be removed by rebooting the computer, or killing the browser process in task manager.

The harmful scripts were removed from it in 2012. There are also alternate versions of this malware, containing shock content.

**NOTE: Developing malware that aren't for educational/research purposes is illegal and can result in legal consequences. This page is for informational purposes only. Do not use this information to develop malicious programs.**
McAVG 2011

McAVG 2011 interface

McAVG 2011 is a malicious security application which was created by cyber terrorists to trick you into thinking that it’s a legitimate tool, anti-virus program. Even more, just like earlier released fake AVG Antivirus 2011, it has been created to make you think that it is as reputable as completely legitimate Kaspersky lab’s products because it has almost the same looking design. However, you can be sure that you will install just another virus which additionally will start making you think that your machine is infected with viruses and only ‘licensed’ version of McAVG 2011 will save you. The only thing that will definitely help for you is a truly reputable and legitimate anti-spyware, such as spyhunter or other. Its ‘full’ version will help you to protect your machine against the secret intrusion of such scams and remove their files.

McAVG 2011, just like earlier malwares released to gain the income, enters poorly protected computers with the help of Trojans and then starts paying havoc on these PCs. It means that it will drop some harmless files in the system Registry and will also set itself to start as soon as you reboot your computer. Besides, it has been noticed to be using browser hijackers for its distribution, so you may also find yourself unwillingly redirected to www.spycheck.es, www.spycheck.co.uk, www.spycheck.eu, www.spycheck.fr, www.spycheck.nl, www.spycheck.it, www.spycheck.dk, www.spycheck.pl, www.spycheck.ru.

Additionally, you will receive numerous alerts and scanners of McAVG 2011 posing to be checking your PC for viruses and then alerting about tens of them detected. These files in reality are nothing else but the same files created by malware earlier. McAVG will do its best in trying to make you think that your computer is in danger because it is designed for one basic reason which is to steal your money.

Mc AVG 2011 will keep running its startup scanners until it is not eliminated. Though it will ask you to pay only 5 euros for its removal and protection services, don’t fall into its trap and purchase it. As a result, you will receive more scanners and warnings that will return completely predetermined results. Please, take you time to realize that this software is not real antivirus and that it has been designed for commercial reasons – stealing the money for scammers. Besides, it may also get your credit card details and other important information if you agree to pay. So, in order to protect your computer and your privacy, remove McAVG 2011.
Rickrollware

## What it is

Rickrollware is a joke program malware made by Replit user Nuker13764 made on June 7, 2022. It overloads your computer with opening tabs as long as it is run. It opens up two videos of Never Gonna Give You Up.

### History

When it was first created on June 7, 2022 it opened 1024 tabs of Never Gonna Give You Up. Until it was changed on June 16, 2022 to repeat forever.

It asked "Are you sure you want to be Rickrolled 1024 times?"

## How it works

It asks for confirmation "Are you sure you want to be Rickrolled infinite times?".

If accepted then it opens Never Gonna Give You Up infinite times.

## How to remove it

### Chrome

If started on Google Chrome then right click the Rickrollware tab and choose "Close Tabs To The Right" to remove the videos. Then close the window with the Rickrollware tab.

### Firefox

To remove on Firefox browsers or tablets you will have to shutdown Firefox, or if ran long enough even the whole device.
Trojan

A **Trojan horse** is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk. In one celebrated case, a Trojan horse was a program that was supposed to find and destroy computer viruses. A Trojan horse may be widely redistributed as part of a computer virus.

The term comes from Greek mythology about the Trojan War, as told in the Aeneid by Virgil and mentioned in the Odyssey by Homer. According to legend, the Greeks presented the citizens of Troy with a large wooden horse in which they had secretly hidden their warriors. During the night, the warriors emerged from the wooden horse and overran the city.

Trojans act like they are legitimate, but they can use your computer, damage the computer, steal information or even do harmful actions to your data and network. Trojans can even cause identity theft and other cyberattacks. Some trojan even download malware and turn off security. Some trojans hijack the computer and make it a part of a botnet; which can send spam messages, steal data, and launch DDoS (Distributed Denial of Service) attacks.

## See also

* Vundo
* Zlob
Malware Wiki:Candidates for deletion

Please use this page to discuss pages with deletion notices.

```
Please express your opinions for each page by saying {{Keep}}, {{Remove}}, {{Neutral}}, or {{Merge}}.

```

## Example Page

 **Keep** - Yeah. Keep this page. It's helpful.  **Example user signature** (wall • contribs • edit count • logs)

 **Delete** - Remove this page. It has no content.  **Example user signature** (wall • contribs • edit count • logs)

 **Merge** - Merge it with JJ! Thanks.  **Example user signature** (wall • contribs • edit count • logs)

 **Neutral** - I don't know.   **Example user signature** (wall • contribs • edit count • logs)
MAC Defender

Window

**MAC Defender** is a rogue antivirus targeting macOS. It was discovered in May 2011. It has been described as the first major malware threat to macOS.

## Distribution

This program usually pops up when the user opens an image on a search engine. It also appears in malicious links.

## Payloads

The website shows a fake scanner claiming to detect viruses. It downloads a ZIP file if the user clicks any buttons; and unzips it if the "Open 'safe' files after downloading" option is turned on.

Once MAC Defender is installed, it adds itself to login items so it will run automatically when the user logs in. It will say that the user needs to pay to get rid of the "virus". MAC Defender will also try to open webpages every few minutes.

## Trivia

* The website used to look like the Windows XP file explorer
ThinkPoint (Rogue)

## Payload

ThinkPoint will first pose as a simple Flash Player updated, although when run it will display a fake Microsoft Security Essentials alert, claiming an Unknown Win32/Trojan has breached the system (which is rare in these cases that the legitimate one finds a trojan that is not known). The user will likely select "Clean Computer", which will recommend you "Scan Online". Once you've scanned online, and the software will supposedly recommend that you activate a Free Trial of "ThinkPoint" and the infected PC will restart.

The infected system will boot into a splash screen, with two options "Normal Startup" and "Safe Startup". Of course, Normal startup will not be available until you configure the settings. Once the user starts the scan, RegEdit and CMD have been unblocked, but it will still block task manager (unless the user finds a way to get past it's blocklist by copying the task manager application and renames it to where ThinkPoint won't detect it).

Once the user configures the application in such a way that they can perform an Un-Safe startup they will boot into Windows. The user may now proceed to remove the program.

## Removal Process

1. When ThinkPoint starts, immediately press CTRL+ALT+DEL. Now select Task Manager and kill the process.

2. Now, start a new task "Explorer.exe"

3. From here, you can simply download Malware-Bytes Anti-Malware, and your system will be clean.
Firewall

A **firewall** is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system. It is also a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all computer traffic between different security domains based upon a set of rules and other criteria.

A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

There are several types of firewall techniques:

1. Packet filter: Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.
2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.
Downloader Generic

**Downloader Generic** is a malicious application that allows hackers to remotely access your computer system letting them modify files, steal personal information and install more unwanted software. Downloader Generic is currently ranked 12 in the world of online malware, affecting between 1,000,000 and 5,000,000 users, in 183 countries.

## Aliases

* Downloader Generic(AVG)
* TrojanDownloader:Win32/Generic(Microsoft)
Joshi

Creator
 Date Discovered
 Place of Origin
 Source Language
 File Type(s)

**Joshi** is a boot sector virus from 1990 that is able to infect hard drives. With regard to floppy disks, it only infects 360 kilobyte and 1.2 megabyte 5.25 inch floppies.

It was made by Manav Joshi, a software engineer in Mumbai.

## Behavior

When the system is booted with a disk infected with Joshi, the virus will become resident in memory and takes up about 6,000 bytes. The virus infects the partition tables of hard disks. It also infects any floppy disks that are accessed while the virus is resident.

On hard disks, the rest of the virus would be stored at track 0, sectors 2 to 6. The original partition table will be stored at track 0, sector 9. On floppies, it will be at 41, sectors 1 to 5 on 360 kilobyte disks and track 81, sectors 1 to 5 on 1.2 megabyte disks.

It causes any attempt to format the disk to fail with a "bad track 0" error. In addition, it protects its sectors from being overwritten by the Stoned virus. Any attempts to read the boot sector will be redirected to the copy of the boot sector.

On January 5th of any year, the screen will turn green and the text "Type Happy Birthday Joshi" will appear. The system will not respond until "Happy Birthday Joshi" is typed.

## Effects

The virus originated in India, and managed to spread to Africa. It may have also made it to Germany and other parts of Europe and America.

## Name

The virus gets its name from the text it displays and demands the user type on their screen. This virus has also been called "Joshua" probably because of the similarities between the names Joshua and Joshi. Joshi is a relatively common family name in India.

Virus is Made in INDIA/GUJARAT/NADIAD

Name is Mr. Vikram Joshi Live In Nadiad

His birthday is actually May 1st and as indian standard is DD-MM-YY and us Standard is MM-DD-YY that why it's show on 5th of January actually Mr. Joshi's birthday is at 1st of May... his contact number is 9825262284.

## Sources

Mike McCune. Virus-L, Removing Joshi virus (PC). 1990.10.18

McAfee Antivirus, Joshi. 1990.06.15
DOS

**This article is not about a piece or type of malware, it's about an operating system.**   **DOS**, short for "Disk Operating System", is a shorthand term for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions Windows 95, 98, and ME.

Related systems include MS-DOS, PC DOS, DR-DOS, FreeDOS, PTS-DOS, ROM-DOS, JM-OS, and several others.

In spite of the common usage, none of these systems were named simply "DOS" (a name given only to an unrelated IBM mainframe operating system in the 1960s). A number of unrelated, non-x86 microcomputer disk operating systems had "DOS" in their name, and are often referred to simply as "DOS" when discussing machines that use them (e.g. AmigaDOS, AMSDOS, ANDOS, Apple DOS, Atari DOS, Commodore DOS, CSI-DOS, ProDOS, and TRS-DOS). While providing many of the same operating system functions for their respective computer systems, programs running under any one of these operating systems would not run under others.

## External links

* *MS-DOS Reference* — MS-DOS commands; many also apply to other DOSes on the PC platform.
* Timeline of DOS and Windows versions
MeltingScreen

Creator
 Date Discovered
 Place of Origin
 Source Language
 File Type(s)
 Aliases
 Family

**Email-Worm.Win32.Melting** or **Melting**(also known as **MeltingScreen**) worm claims to be a cool new screensaver, as long as you have the visual basic runtimes installed! Instead of being just a screensaver, the worm activates very maliciously.

## Behavior

Melting is a virus-worm that spreads via the Internet. The worm itself is a Win32 PE EXE file about 18Kb in length, and it is written in VisualBasic. It is transferred through email messages with infected attachments with the "MeltingScreen.exe" name. When an infected message is received and the attached EXE file is executed, the worm gains control and starts its spreading routine. This routine connects to MS Outlook, enters the address book, obtains Internet addresses from there and sends messages by using these addresses. The messages have a copy of the worm in the attachment with the Subject "Fantastic Screensaver", and the message body appears as follows:

```
Hello my friend!

Attached is my newest and funniest Screensaver, I named it MeltingScreen.

Test it and tell me what you think.

Have a nice day my friend.

p.s.: Please install the Runtime Library for VB 5.0, before you run the ScreenSaver.

```

The worm then gains access to the Windows directory and renames all EXE files there with a BIN extension. The worm has bugs and often hangs a computer when run. The worm actually has screen-saver ability. After spreading and renaming EXE files to BIN, it "melts" the screen.
Solaris.exe

Solaris.exe is a trojan created by Nikitpad. It is a GDI trojan that can also replace the BootMGR with Betelgeuse, a later on payload that will let you play a game.

Note: Solaris.exe will destroy the virtual machine aka making it an unusable machine, if you dare to try it out, you will face the fun.

Solaris.exe's 1st warning Title Box when starting the trojan is a quote from Harlequin Forest,

Betelgeuse

The Betelgeuse payload consists of fractal loops, with an interactable Mandelbrot Viewer later on.

There is a timer in the Betelgeuse payload and also a moving rectangle that features what Nikitpad says.

After the timer stops, there will be a game where you just walk around. There are 4 cubes, the QR cube redirects you to an ARG
Microsoft Windows

**This article is not about a piece or type of malware, it's about an operating system/OS.**

**Microsoft Windows** is a series of operating systems and graphical user interfaces produced by Microsoft. Microsoft first introduced an operating environment named *Windows* in November 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces (GUIs). Microsoft Windows came to dominate the world's personal computer market, overtaking macOS, which had been introduced previously. As of July 2009, Windows had approximately 93% of the market share of client operating systems for usage on the Internet. The most recent client version of Windows is Windows 11, which was released on October 5, 2021.

## External links

* Official Microsoft Windows Website
* Microsoft Developer Network
* Microsoft Windows History Timeline
* Pearson Education, InformIT – History of Microsoft Windows
Malware Database Wikia

## Welcome to the Wiki

Welcome to the wiki. We’re a collaborative community website about your topic that anyone, including you, can edit. Click the edit button at the top of any page to get started!

## Describe your topic

Write a description about your topic. Let your readers know what your topic is about and add some general information about it.

## Latest activity

Photos and videos are a great way to add visuals to your wiki. Find videos about your topic by exploring Wikia's Video Library.

File:Placeholder
Monoxide.exe

# Payloads

### First Payload

Monoxide's first payload is by cloning the Cursor and each clone moves in a random position, these clones are active and click without the mouse clicking, and like any normal cursors, they can right or left click.

### Second Payload

The second payload is by opening .DLLs and other System 32 And SysWOW 64 files. Mostly opened in a browser and the cursors can play around with the .DLLs that have been opened

### Last Payload

The last payload is where it is about to shut down the computer as it replaces the Master Boot Record.

### BootMGR

The BootMGR now replaced by the trojan now consists a rainbow loop, the text that appears says "This system has been deleted by Monoxide"