recursal/Fanatic-Fandom huggingface dataset:
Дора

**Дора (англ.*Dot*)**- это персонаж из мультфильма Приключения Флика

Принцесса Атта

Королева Муравьёв (мама)

Колония муравьёв

Плохие

Хоппер

Чебурашка

Саранчи

## Личность

**Дора** — младшая принцесса из семьи королевы муравьёв. Испытывает к Флику сочувствие и братскую любовь, ценит его талант. Хочет побыстрее выйти из детского возраста и научиться летать (у неё есть маленькие крылья, но они начинают работать только ближе к концу фильма).

## В фильме

В начале Дора уже демонстрирует то что она пока не умеет летать, но очень этого хочет, также ей пытаться летать запрещает мама Королева, поскольку она говорит что крылья ещё не окрепли. Дора на протяжении всего фильма будет именно тем муравьём у которого хорошие чувства к Флику, в отличии от других. Дора также очень сильно боится Чебурашку ручного питомца Хоппера. В конце фильма она становится следующим наследником трона , так-как Атта уже стала королевой.
The Divines

Divines are powerful deities that exist in physical form. Their power comes from their followers and worshipers. Divines often meddle in the affairs of the mortals, working to protect themselves, their followers, and accomplish their own goals. Many Divines choose a mortal champion to work for them. They create powerful artifacts they use to manipulate mortals.

Ryheus, God of Justice and Order
paladins
Ibus, God of Nature
druids, wood elves
Astrid, Goddess of Shadows and stealth

Valari, Goddess of Life
Etnali
Basva, Goddess of the Death and Underworld
necromancers, Ytheran
Ahesis, God of the Hunt,
Baer
Tempstrada God of Storms,
Avians
Corsa, God of Sea,
Merpeople
Dracultus, God of power,
dragons
Melgador

Melgador is a large continent located in the North East of the known world. Due to it's location, winters on the continent are cold and long, and in the northern reaches of the country they can be brutal. In the southern and prairie provinces, the daily average temps increase significantly, allowing for successful agriculture and much easier lifestyle.

 Ancient Civilizations

> See Ancient Melgador for More Info
>
>

Many peoples across the land of Melgador tell stories of ancient times, millennia ago, when enormous dragons tore apart the land with magic and fire. Fighting a war for supremacy over Al'Dor, only the most powerful, **Dracan Vantari** or Dragon Lord, in the new words, were able to survive. From the monster's bones scattered across the land, we can suspect that these dragons slaughtered each other for centuries until only a few remained. It is said that after the land was badly burnt and torn, a great flood came to extinguish the fire, but with the fall of such power, awoke an even more ancient race, known to the people of Melgador as The Behemoths. Existing in various forms, these beasts tended to be passive unless angered, however there are many known cases of unprovoked behemoth attacks. Following the Age of Fire and the great flood, civilizations of man, elf, and dwarf quickly began to dominate all corners of the land. From the frozen tundra of Everwinter to the Silver shores, a plethora of small civilizations taking various forms are known to have existed in the time before the Ryn'em. While most of the knowledge that was kept has been lost, we are able to piece together our history through stories passed on and through incomplete Ryn'em records destroyed during the fall of the empire.

There were countless groups of peoples living in Melgador prior to the appearance of the Ryn'em, however they can be grouped into seven categories, as this is how they appeared to the Ryn'em. The small groups were first established by leaders who were able to gather the resources and followers to establish the first centers of civilization. However the first kingdoms were frail in both defenses and willpower, and as time passed, the ancient behemoths of Melgador proved to be an enormous hindrance to their success. Over decades of hard work and cooperation, the First Kingdoms developed the technology and fighting abilities to combat these massive beasts. Eventually these kingdoms grew to considerable size, providing the initial groundwork that would lead to the success of the Ryn'em empire. While some of this information comes from written sources, most is a compilation of stories and legends passed on for centuries.

## Geography

### **Mountains**

The Spire - located in Atlas

The Pass - located in Whitethorn

## History

Creation - year 800 see History of Winterfall
Гарофало, Джанин

Шаблон:Однофамильцы
Шаблон:См. также

**Ошибка скрипта: Модуля «Wikidata/category» не существует.**Шаблон:If-wikidataШаблон:Проверка IMDb**Ошибка скрипта: Модуля «CategoryForProfession» не существует.**

**Джанин Гарофало** (англ. *Janeane Garofalo*, род. 28 сентября 1964) — американская стендап-комедиантка, актриса, теле- и радиоведущая, политический деятель и сценарист.

## Карьера

Гарофало начала свою карьеру как стендап-комик в конце 1980-х. Она достигла популярности за свои высмеивания поп-культуры и общественных шаблонов. Позже она начала карьеру на телевидении, которая принесла ей две номинации на премию «Эмми». Она достигла более широкой известности выступая на шоу «Субботним вечером в прямом эфире» в период между 1994—1995 годами, а также была приглашенной звездой в таких сериалах как «Сайнфелд», «Без ума от тебя», «Эллен» и др.

Её прорывом в кино стала роль в фильме 1994 года «Реальность кусается». В 1996 году она сыграла свою первую главную роль в Голливудском фильме «Правда о кошках и собаках», который был хорошо принят критиками и стал успешен в прокате. Гарофало также стала известна за свои колкие высказывания в интервью. В 1996 году она достигла пика своей популярности выступив в качестве ведущей «MTV Movie Awards». В 1998 году сыграла в фильме «Тонкая розовая линия».

Из-за нежелания играть просто красивых девушек Гарофало отказалась от главных ролей в фильмах «Джерри Магуайр» (роль позже досталась Рене Зеллвегер), «Крик» и «Бойцовский клуб». Вместо этого она предпочитала играть главные роли в независимых фильмах, а также характерные в голливудских. У неё были комедийные роли в фильмах «Полицейские», «Роми и Мишель на встрече выпускников», «Догма», «Кабельщик», «Прощай, любовь».

В последние годы она была заметна своими ролями на телевидении, в таких сериалах как «Западное крыло» (2005—2006) и «24 часа» (2009). В 2011 году у неё была одна из главных ролей в сериале «Мыслить как преступник: Поведение подозреваемого», который был закрыт после одного сезона. В 2014 году она снялась в сериале «Руководство подруг к разводу», который покинула в процессе съемок первого сезона.

## Политические взгляды

Шаблон:Перевести раздел

Активно выступает в политических дебатах с феминистических и прогрессивных позиций.

## Личная жизнь

Гарофало в шутку вышла замуж за Шаблон:Нп5 (сценариста «Шаблон:Нп5») в 1991 году в Лас-Вегасе, не думая, что церемония действительно узаконит их союз. Спустя 20 лет, когда Коэн попытался жениться на другой, выяснилось, что его брак с Джанин легитимен, и в 2012 году они развелись.

Гарофало — асексуалка. В 2010 году во время стендап-шоу «If You Will» в Сиэтле (Шаблон:Нп5) Джанин сказала: «Шаблон:Comment, Шаблон:Comment».

## Примечания

1. ↑ Шаблон:Cite news
2. ↑ Шаблон:Cite news
3. ↑ Шаблон:Cite web
4. ↑ Шаблон:Cite web
5. ↑ Шаблон:Cite news
6. ↑ Шаблон:Cite news
7. ↑ Шаблон:Cite web

## Ссылки

Шаблон:Навигация

* Official website
* Janeane Garofalo’s political donations

Шаблон:ВС
REDIVIVIAN

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah

behi azadini w galal bugha faya qawmi hubu lidarbil kumah
fa ima hayatun tasurul hudah wa ima ma'matun yughighul uda
wa ima ma'matun yughighul uda

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah

faqum yaw'faya lidarbin naja lilamdi saweeya nasudul ghuza
wa narfa umajida wa nu'leh jiba abat antadila be ghairil ilah
abat antadila le ghairil ilah

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah

il al haqi haya da'ana lewa
li sahil manaya be harbi aydah
faman ma ta'minna fi dan an himah
bi janati khuldin sayaghdu azah
bi janati khuldin sayaghdu azah

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah

saleelul sawarim nasheedul ubah
wa darbul qitaly tariqul haya
fa baynaq tihamin yubidu tugha
wa kateem musawtim jamilun sadah
V-Sign

Creator
 Place of Origin
 Source Language
 Infection length
 Reported costs

**V-Sign** also known as **Cansu** and **Sigalit** is a boot sector virus from 1992. It is slightly polymorphic and displays an image after infecting 64 diskettes.

## Behavior

When the system is booted from an infected diskette, V-Sign becomes memory resident, taking up 2,048 bytes. It installs itself in high memory, just below the DOS 640k boundary. The virus infects the hard disk as soon as the user accesses it.

V-Sign saves 38 bytes of the master boot record in its own code as it overwrites Side 0, Cylinder 0, Sector 1. Its code takes up two more sectors, so it places the rest of itself on Side 0, Cylinder 0, Sectors 4 and 5.

Diskettes are infected as they are accessed. It works the same way as when it infects a hard disk, except on the floppy, it stores its two other sectors on the last sectors of that disk's root directory (sectors 10 and 11 on 360k 5.25 inch floppies for example).

When the virus has infected 64 diskettes, it will display its "V Sign". At this time, it causes the system to hang.

## Name and Origin

V-Sign most likely comes from Turkey, but India has also been considered a possible home country of this virus. It was first reported in Canada. V-Sign takes its name from the image it displays. Its other name, Sigalit is Hebrew for the violet plant. Cansu is a Turkish female name.

## Sources

McAfee Antivirus, V-Sign. 1992.06.15

F-Secure Antivirus. F-Secure Virus Descriptions : V-Sign.

Learn Hebrew Names. Sigalit - סִיגָלִית.
000.exe

000.exe is malware that can be installed on Windows computers to perform malicious actions on it. Initially developed by a YouTuber FlyTech, it was created as more of a joke than something that would provide any real benefit. Indeed, the virus is relatively easy to get rid of.

## Removal

While this virus might not be your dangerous malware infection spread by sophisticated cybercriminal groups, it does not mean that its presence should be ignored. In fact, when it comes to the malware's function, it is almost impossible to ignore it, as it would make the operation of a Windows computer unbearable.

Luckily, it is not that difficult to remove the 000.exe virus from your system. Below we will explain more about its functionality, what's its goal, how to clean your system properly from it and repair damaged Windows components efficiently. Likewise, we also provide general tips for better security to avoid dangerous malware infections in the future.
Scareware

**Scareware** is malware designed to scare the user into paying for unwanted software. These applications include rogue security software, ransomware and other scam software.

## Screamers

The "scareware" label can also apply to any application or virus which pranks users with intent to cause a reaction.

There are also alternate versions of scareware designed to literally scare the user with a shocking image with a loud noise, such as NightMare or Windows XP Horror Edition.
Malware Database Wiki:You're Now A Bureaucrat!

Welcome to the Bureaucat page! Here, you can see how to control your editing powers, and people will start getting use to you.

## Starting

Before you read, please see if you've done:

* Being supportive and kind to users
* Introducing new users to the site
* Haven't been a troll to people or playing pranks on a user
* Haven't threatened people in chat rooms (Talk) or comments

If you've completed all these, then you're as we say, a King.

You get sent the message on your Message Wall saying:

```
**You're now a bureaucat!**

```

```
Congrats [username], you have been chosen to be a bureaucat on this site! You'll be working with me. ;)

```

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

That is what you'll get for being such a great user!

## Can't do what?

Even though you're now a admin/bureaucat/rollback, there are a few things you shouldn't do:

1. You can't delete or edit the article to heck.
2. You shouldn't ban everyone just because you're annoyed or because you want someone trolled.
3. **DO NOT** edit the background or logo.

You must follow these rules to not become a normal user again.

## Can I talk to you?

Sometimes, One time I might be off watching YouTube videos, or maybe I'm not talking because I'm finishing/editing an article. So really, it depends.
Potentially unwanted program

A **PUP** (potentially unwanted program) is a program that may be unwanted, despite the possibility that users consented to download it. PUPs include spyware, adware, and dialers, and are often downloaded in conjunction with a program that the user wants.

The term was created by McAfee because marketing firms objected to having their products called "spyware": in the view of such firms, all the information necessary for informed consent is included in the download agreement. It is widely recognized, however, that many if not most users fail to read a download agreement in sufficient detail to understand exactly what they are downloading.

McAfee differentiates PUPs from other types of malware, such as viruses, Trojans, and worms, which can be safely assumed to be unwanted by the user.
Pro-Alife

This page was heavily influenced by The Malware Wiki's Page on Pro-Alife

## Variants

**Virus.DOS.Pro-Alife** is a virus that runs on MS-DOS.

There are 3 variants:

* Virus.DOS.Pro-Alife.3421
* Virus.DOS.Pro-Alife.3423
* Virus.DOS.Pro-Alife.3423.b

## Behavior

Once the program is launched, it hooks itself onto INT 21h (the Keyboard Input with Echo handler)[1] and then spreads by writing to the end of an EXE file.

### Hash

When one of the infected files are terminated, the virus will print a random string:

```
[0] Kill an evil satanic ANTI-VIRAL product for Jesus today!
[1] Stop Disinfectants NOW!
[2] Ain't aLife A Beautiful Choice?
[3] And God Said, "Let There Be Life!", and there was.....
[4] Save the Viruses!  They're People Too!!!!
[5] PRO-aLIFE and PROUD!  STOP THE VIRUS KILLERS! HALT THE AV!
[6] STORM THE COMPU-CLINICS!  DON'T LET THEM KILL THE VIRUSES!!!
[7] Operation Rescue-II, Save the HELPLESS UNBORN Viruses!!!

```

## Payload

Instead of running the anti-virus program, it will run this instead.

The largest text reads "8440c021" and displays 2 phages.

```
Eddie Lives, Somewhere in time!  ____________      1704     Jerusalem
Casino  :( ;( =(  Smeg off!      _____ ____  \   Frodo Lives!  APRIL FOOLS!
Get a late pass!    Datacrime    _______________        Brain   Void-Poem
Your PC is now STONED!           __ OO _____ O _  Copy me, I want to travel!
1,000,000,000 Viruses DIED Today!
And yesterday, and more will die tomorrow!
_/\_STOP THE KILLING!_/\_
Look What You're Doing To Them!
Below is an aborted virus... Support PRO-aLIFE Activism!
This program has been TERMINATED by the Virus Survival Underground Movement.
It had long stood as a horrible BABY VIRUS KILLER, and had to be removed.
Life, What a Beautiful Choice (tm).
--==___[OPERATION RESCUE II - SAVING THE BABY VIRUSES!]___==--
Thank you for choosing life over destruction.
Have a Nice Day (tm).

```
You Are An Idiot 2

**This article is about **You Are An Idiot 2**, you may be looking for YouAreAnIdiot.**

 Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Aliases
 Family
 File Size
 Infection length

**You Are An Idiot 2** - is a threat, created by ComputerVirusWatch in 2013 (a year after the script from the original website was removed). It is from family Trojan:JS/NoBrain.

## Information

This threat was created by ComputerVirusWatch in 2013. The goal of the threat is to demonstrate how the original YouAreAnIdiot threat, which was removed from the original page, worked like, that means crashing the user's computer.

In the Internet Explorer browser without the popup blocker, when the website is visited, the malware shows a big window, that bounces around user's screen, singing that they are an idiot. When the window is closed, it opens 6 more, and they open the same page and sing the same song and fly over the screen. It also disables CTRL+ALT+DELETE and ALT+F4, instead displaying the following message:

```
You are an Idiot!

```

If the user's version of Internet Explorer is lower than 6.0, the threat sets the user's homepage to its own website.

Note: this doesn't work on Firefox, Chrome and other browsers.
User requests for user rights

# **Welcome to User Rights requests**

Here you can post your requests for user rights

Available Positions

* Administrator
* Bureaucrat
* Chat Moderator

## How to set out a request

Introduce a request with the code ""==<your username>==", then fill in the following information.

* **Username**: **~ ~ ~ ~** [No spaces]
* **Edits**: *Insert number of edits*
* **Current Rights**: *Most cases: Put <none>*
* **Rights wanted**: *<Insert rights>*
* **Reason**: *Explain why you want these rights*

Kitty0706Lover (talk) 12:23, July 13, 2014 (UTC)

**Insert requests below**
Trovi

**Trovi**, also known as **Trovi Search**, is a browser hijacker that redirects your homepage to trovigo.com.

## How To Remove It

First, you click Start > Control Panel > Programs or (Add/Remove Programs) Uninstall a Program. Secondly, look for Trovi Search, Trovi, Search Protector, Conduit and other similar programs, then uninstall. Save the changes, and Lastly, remove it from your browser. But with Firefox, you just reset Firefox, and also with Internet Explorer or Chrome, remove "Trovi search" from the search providers.
Bad Rabbit

**Bad Rabbit** is a Ransomware type malware. It spreads using a Fake Flash installer.

## Payloads

Once the fake installer is run, the ransomware will shut down the computer and encrypt the user's files. The infected system reboots a second time. It's MBR is encrypted and then the computer displays the ransom note instead of booting into the OS.

Bad Rabbit spreads to other computers by dropping copies of itself into the network.

## Trivia

* This ransomware is based on Petya.
* It contains references to *Game of Thrones.*
Skism

Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Aliases
 Family
 Reported costs

 **Virus.DOS.Leprosy.Skism.1992** or **Skism** is a virus that runs on MS-DOS.

## Behaviour

Skism is a pretty destructive virus that will prevent boot on a certain date. When you launch the virus on the 25th of any month (if the day is Friday), it will display the message below. Rebooting on this date causes the message to show up again. It is impossible to get any work done on Friday the 25th.
Sodinokibi

What Sodinokibi Ransomware looks like.

**Sodinokibi** (also known as **REvil**) ransomware was first detected in April 2019 and linked to the retired GandCrab. From that point on, Sodinokibi launched several high-profile attacks that continued throughout 2020, thus making a name for itself as one of the ransomware families that should be watched out for.

## Technical analysis

The threat actors behind Sodinokibi typically hire a variety of affiliates for their initial access. Their attacks often begin with techniques like malspam emails with spear-phishing links or attachments, RDP access that uses valid accounts, compromised websites, and exploits. They also use techniques that indicate their targeted approach.

***Initial access***

We observed the use of several of these initial access techniques. For example, as with campaigns, we saw the use of the CVE-2019-2725 vulnerability and observed an instance where Sodinokibi was loaded in the memory of PowerShell through reflective-load instead of binary execution. We also saw malspam that led to the use of a macro to download and execute the malware.  CVE-2018-13379 and CVE-2019-11510 are also used by the malware, as well as compromised valid accounts. This allows the threat actors to drop and execute other components like the anti-antivirus, exfiltration tools, and finally Sodinokibi itself.

***Lateral movement and evasion tactics***

Sodinokibi, like many ransomware families known today, have a targeted approach with regard to their campaigns. In line with this, we observed the use of RDP and PsExec for lateral movement — a sign of targeted attacks — to drop and execute other components and the ransomware itself.

We also observed that PC Hunter and Process Hacker are used to terminate services or processes, especially those services and processes that are related to antivirus software.

Once the system is infected, Sodinokibi sends a report and system information to its command-and-control (C&C) server. It generates a pseudorandom URL based on a fixed format and generation to add to a list of domains in its configuration.

### Security recommendations

Sodinokibi has been known to target high-profile entities and uses notable evasive tactics. Organizations should, therefore, be wary of its techniques. For now, here are some best practices to prevent similar ransomware attacks:

* Avoid opening unverified emails or clicking on their embedded links, as these can start the ransomware installation process.
* Back up your important files using the 3-2-1 rule: Create three backup copies on two different file formats, with one of the backups in a separate location.
* Regularly update software, programs, and applications, to ensure that your apps are current, with the latest protections from new vulnerabilities.

## Indicators of Compromise (IOCs)

 04ae146176632509ab5239d0ec8f2447d7223090
 10682d08a18715a79ee23b58fdb6ee44c4e28c61
 169abe89f4eab84275c88890460a655d647e5966
 20d90f04dcc07e1faa09aa1550f343c9472f7ec6
 2a75db73888c77e48b77b72d3efb33ab53ccb754
 58d835c3d204d012ee5a4e3c05a06e60b4 316d0e
 Ce0c8814d7630f8636ffd73f8408a36dc0e1ca4d
Hurr-Durr

**This article is about **the trojan with the same name**, you may be looking for Hurr-Durr.exe.**

### OS

Vulnerable Internet browsers & Internet Explorer

**Hurr-Durr** was a trojan horse registered on September 17th, 2009 referencing the "Hurr-Durr" meme. The website consists of a Flash animation of a dog shaking its head with three captions in the font Comic Sans, such as the following:

* *HURR?*
* *DURR!1*
* *HURR - DURR*

However, right after a few seconds a window would appear that would move around the screen, featuring the same content. Whenever the user tried to close the window, a prompt would pop up consisting of words similar to "Hurr-Durr".

Since then, the website has closed. However, the YouTuber Enderman made a revival of the site.
Mummy

**Mummy** is a memory-resident companion infecter, creating an infected .COM file containing the virus for every targeted .EXE file. It is a member of Qark's Incest "family", which in includes Daddy, Sister and Brother. It appeared in the July 1994 issue of VLAD magazine, along with other members of the Incest family.

## Behavior

Under MS-DOS if no file extension is specified to execute a file, .COM had priority over .EXE. These 'infected' .COM files ran the virus, then executed the original .EXE file. Mummy first executes the original .EXE file when run and then goes resident by directly hooking INT 21h and calling INT 21h, AX=3100h (Terminate and Stay Resident).

Mummy is encrypted, and also uses a similar prefetch trick to the one used by 'Daddy', in an attempt to avoid debugging, F-PROT and Thunder-Byte Anti-Virus. Mummy uses an interesting stealth mechanism. Companion .COM files are created with the 'hidden' attribute set. When ASCII FindFirst is called (INT 21h AH=4Eh), Mummy removes the 'hidden' bit from the requested attributes mask so that hidden files are not enumerated. This leads to many anti-virus programs not seeing the companion infections.

Mummy includes the text strings:

```
[Mummy Incest] by VLAD of Brisbane.
Breed baby breed!

```

## Sources

Original research by JPanic aka @JPanicVX
THE ISLAMIC STATE WILL RISE

> IMPERIALISTS
>
>

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah

behi azadini w galal bugha faya qawmi hubu lidarbil kumah

fa ima hayatun tasurul hudah wa ima ma'matun yughighul uda

wa ima ma'matun yughighul uda

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah

faqum yaw'faya lidarbin naja lilamdi saweeya nasudul ghuza

wa narfa umajida wa nu'leh jiba abat antadila be ghairil ilah

abat antadila le ghairil ilah

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah

il al haqi haya da'ana lewa

li sahil manaya be harbi aydah

faman ma ta'minna fi dan an himah

bi janati khuldin sayaghdu azah

bi janati khuldin sayaghdu azah

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah

saleelul sawarim nasheedul ubah

wa darbul qitaly tariqul haya

fa baynaq tihamin yubidu tugha

wa kateem musawtim jamilun sadah
Mimail

Creator
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Reported Costs

**Mimail** is an email worm that steals passwords and was reported to have caused billions of dollars in damage.

## Behavior

The worm arrives as an email that appears to be from the administrator of the user's domain. If your mail address is kiki\_the\_black\_cat@kitty.cc, the sender line will read admin@kitty.cc. The subject line is "your account" followed by a random string of numbers and letters. The message body informs the user that there is important information about their email account in the attached zip file, Message.zip.

Message.zip contains an htm file, Message.htm, which once opened in unpatched versions of Internet Explorer, creates the file Foo.exe in the temporary internet files folder. Foo.exe is actually the Mimail worm. While Foo.exe is running, the browser shows a black field with red text saying "Please wait loading message.....". Mimail copies itself to the Windows folder as Videodrv.exe. The worm adds the value "VideoDriver = (Windows directory)\videodrv.exe" Local Machine registry key that runs programs on startup It creates another registry key with the value "{11111111-1111-1111-1111-111111111111}".

The worm will capture text from some windows and send the information to a specific email address.

The worm then saves three files to the Windows directory, one, Zip.tmp, a temporary copy of the attachment, Message.zip, a copy of Message.html and eml.tmp, where it will store the email addresses it finds.

Mimail collects email addresses from local files and writes them to the file Windir\eml.tmp. The email addresses will be collected from files with the following extensions:

* .bmp
* .jpg
* .gif
* .exe

* .dll
* .avi
* .mpg
* .mp3
* .vxd
* .ocx
* .psd
* .tif
* .zip
* .rar
* .pdf
* .cab
* .wav
* .com

The worm has its own Zip file format for creating the Zip file and has its own SMTP engine to send infected files. It also has its own smtp engine to send copies of itself.

## Sources

Atli Gudmundsson, Scott Geddis, Symantec.com, W32.Mimail.A@mm

F-Secure Computer Virus Information Pages, Mimail.A
Wipelocker

the screen that shows up when certain apps are opened

Wipelocker is a trojan that affects Android. It disguises itself as a fake "Angry Birds Transformers" app. When the user installs the fake app, it tries to get admin privileges; it also requests several permissions.

## Permissions Requested

* Edit texts
* Read texts
* Send, and receive texts Read contacts
* Read contents or SD card
* Modify or delete contents of SD card
* Run at startup
* Retrieve running apps
* Prevent device from sleeping
* Modify system settings
* Read phone status and id

## Payloads

Once the app is installed, Wipelocker will delete everything on the user's SD card. If the user opens: Facebook, WhatsApp, Google Hangouts, or a messaging app, It will show a screen saying, "obey or be hacked", with the android logo wearing an anonymous mask.

   Every 10 seconds, Wipelocker will send a message to every contact saying "HEY!!! [Name of contact] Elite has hacked you. Obey or be hacked"; it will also reply to incoming messages saying the same thing.

**NOTE: Developing malware is illegal and can result in legal consequences. This page is for informational purposes only. Do not use this information to develop malicious programs.**
Diesel

Creator
 Date Discovered
 Place of Origin
 Source Language
 Platform
 File Type(s)
 Infection Length

**Diesel** is a harmless direct action infector virus for Linux that places its code in the middle of files it infects while preserving the part in the middle it would otherwise overwrite. It was created by Paddingx in France in 1999 and it appeared in 29A magazine for their 4th issue. It takes its name from some text found in the virus body describing diesel gas.

Table of Contents
Behavior
Variants
Origin
Sources

## Behavior

When a file infected with Diesel is executed, it searches for ELF executables in system directories and subdirectories. Before infecting the file, it removes code from the middle of the file, increases the file's size, then places that code at the end. The virus then places its body inside the removed middle section. Control is then returned to the original host.

It will not infect executables found in the /usr directory, in spite of the many potential hosts there. If run as root, infecting files in this directory will cause the system to crash, even when logging in.

The following text string can be found in the virus body:

```
/ home root sbin bin opt
[ Diesel : Oil, Heavy Petroleum Fraction Used In Diesel Engines ]

```

## Variants

At least two variants of the original have appeared. They are 969 and 970 bytes long. These fix the issue of the system crashing with infection of files in the /usr directory.

## Origin

Paddingx uses an email address with a .fr top-level domain, suggesing he comes from France. As 29A does not date their material, and a significant amount about this virus has been lost, so its date of origin has to be determined from clues about the virus and in Issue 4. The virus was tested on SuSE 6.3, released in 1999.11.05, and one article appearing in the 4th issue has a copyright date by Billy Belcebu in 1999, so it was likely released in the last two months of 1999.

Paddingx claimed inspiration from the Staog virus by Quantum of VLAD, and based much of the code on that virus. It does have a few differences, including that it works on all versions of the Linux kernel.

## Sources

Paddingx. 29A Magazine, Issue 4, D I E S E L.

Kaspersky Lab. Viruslist, Virus.Linux.Diesel.962. 2002.02.08
Malware Wiki:Chat policy

The **chat** room is for socializing, you can join here.

Remember that not have read these policies are not an excuse for inappropriate behavior.

## Chat policies

When you use the chat, you agree **not** to:

* Harass any other members of the wiki
* Post links with explicit content
* Impersonate any other person
* Ask for personal information (address, password, etc.) from another user after the user has told you **not** to ask
* Use explicit language multiple times, there may be younger children here
* Spam

## Emoticons

**Emoticons** are to be used for fun, but not overused. Do not use too many emoticons as it can slow down chat and cause lag.

## Other policies

Moderators may enforce their own policies, such as:

* Common sense. If something that you know will make someone upset, annoyed or angry, do not post it. If you ask the person to stop it and they do, that is fine, but if they do not that will be considered a rule break. This also includes users who come online and "troll".
* Spamming the chat with emoticons or by typing the same thing over and over again.

## Banning

Bans can be made by chat mods or administrators in case rules are broken.

* After the first rule break, a warning must be given.
* After the first warning and the second rule break, a kick will be given.
* After the third rule break, a ban of at least 3 days must be given depending on how severe the rule breaking was.
* After the fourth rule break, the time should be extended. Also, the chat mod may ask an admin about a possible block if they believe it is needed.
* After the extension, the chat mod who performed it should talk to an administrator and tell them.
* If the rules have been broken harshly, the moderator may contact an admin and request to extend the time of banning.

## Unbanning

A banned person may ask an administrator or chat mod to be unbanned if they believe the ban was not justified. You must state the name of the moderator who banned you and what exactly happened and it is best to provide proof (such as screen captures).
Rogue Security Software

**Rogue security software** is a type of malware and scareware that pretends to be an antivirus. It misleads users into thinking that their computer is infected with malware. When installed, the fake program purports to scan the computer and then detects several fake detected spyware or viruses on the computer.

## Propagation

Rogue security software mainly relies on social engineering (fraud) to defeat the security built into modern operating systems and browsers and install itself onto victims' computers. A website may display a fake warning stating that someone's machine is infected with a computer virus, and encourage them to install or purchase scareware thinking that they are purchasing genuine antivirus software.

Some rogues get onto computers as drive-by downloads which exploits vulnerabilities in web browsers, email clients, ect. to install themselves without any manual interaction.

More recently, malware distributors have been using SEO poisoning by pushing infected URLs to the top of search results about recent news events. People looking for articles on such events might encounter results that upon being clicked, instead redirect through a series of sites before arriving at a landing page that saying their machine is infected and tells them to download "trial" of the rogue program.

## Common distribution methods

### Black Hat SEO

Black hat search engine optimization (SEO) is a technique used to trick search engines into displaying malicious URLs in search results. The malicious webpages are filled with popular keywords to achieve a higher ranking in the search results. When the end user searches the web, one of these infected webpages shows up.

### Malvertising

Many websites use third-party services for advertising. If one of these advertising services is compromised or malicious, they may end up inadvertently infecting all of the websites using their service by advertising a fake AV.

### Spam

Spam messages that include malicious attachments and/or drive-by download sites are another common infection vector for rogue antiviruses. Spam emails are often sent with content associated with typical day-to-day activities such as package deliveries, or tax documents, designed to entice users to click on links or run attachments. In drive-by download attacks the malware is installed on the victim's machine, usually without any interaction or awareness and occurs simply by visiting the website.

## Payloads

Once installed, the rogue will attempt to get the user to buy their "product" by:

* Alerting the user with fake "virus detected" notifications
* Displaying an animation of a system crash.
* Selectively disabling parts of the system to prevent the user from uninstalling the malware. Some may also prevent real AVs from running, disable system updates and block access to websites of anti-malware vendors.
* Installing actual malware onto the computer, then "detect" them. (This method isn't as common because the malware will probably get detected by a legitimate antivirus
* Scaring the user by presenting authentic-looking pop-up warnings and security alerts, which may copy actual system notices.
Liste des Escape Games et Escape Rooms de Paris

Il existe actuellement 52 Escape Rooms à Paris. En voici la liste :

### **PRIZONERS**

* Prison de la Bastille (1635)
* Université de la Sorbonne (1935)
* Palais de l'Elyseum (2135)
* Room 135

### **HINT HUNT**

* Le bureau de James Murdock
* Zen Room
* Submarine (missions Torpedo et Sauvetage)

### **GAMESCAPE**

* Le cachot de la Bastille
* Entretien avec Gustave Eiffel
* Le défi de l'alchimiste

### **TEAM BREAK**

* Mission Impossible
* Mission Walking Dead
* Mission Lost

### **THE GAME**

* Braquage à la française
* La danseuse parisienne
* Les catacombes

### **X-DIMENSION**

* La grande évasion
* Le Manoir aux Secrets
* X-Dimension
* Le Secret de la Perle Noire

### **MYSTERY ESCAPE**

* Le Mystère du Manoir
* La Prophétie Maya

### **L'ANTICHAMBRE**

* KGB
* Vaudou
* Contagion
* Ghost
* Momie

### **ESCAPE HUNT**

* Crime au Moulin Rouge
* Poursuite dans le Métro

### **VICTORY ESCAPE GAME**

* Alerte à Voldograd
* La Matrice
* Les cobayes de Shutter Island
* Le Diamant de la Joconde

### **60 MINUTES ESCAPE**

* Les Infiltrés
* Le Cheval du Joker

### **LEAVINROOM**

* Saw
* Le Pays des Merveilles
* Le Tour du Monde en 60 minutes
* Leavincube

### **HAPPY HOUR ESCAPE GAME**

* Les Cachots du Chevalier Noir
* Le virus du Professeur Zoltan
* Attentat à Palamento City

### **ONE HOUR**

* Lost Asylum
* Very Bad Night (ouverture début 2016)
* Yakuza (ouverture en 2016)

### **FOX IN A BOX**

* La banque
* Le bunker
* Le Laboratoire Zombie

### **LOCK ACADEMY**

* Un crime presque parfait
* Très Cher Lock
* Le casse du siècle (ouverture début 2016)
Fidroxidoline

What is it Fidroxidoline.exe This Trojan was created by the author of Dark - Tik. Who creates malware and uploads his Trojans to YouTube and the Discord server. Fidroxidoline is a Trojan with which it creates several beautiful visual effects or abbreviated "gdi effect" which is displayed directly on the desktop of your computer. It hides the taskbar and disables the task manager, cmd, registry editor and so on. And there are also some unpleasant bytebeats sounds.
On4Ever

**Trojan.DOS.On4Ever** or **On4Ever** is a trojan that runs on MS-DOS.

## Details

The length of the trojan is 111 bytes. Being executed it creates the file 00000001.COM, writes itself to there, writes to the keyboard buffer the string 00000001.COM to force DOS executing that file, and exits. Then the file 00000001.COM creates and executes the file 00000002.COM, then 00000002.COM creates and executes 00000003.COM and so on.
Fractureiser

**Fractureiser** is a virus that affected Minecraft mods. It targets Windows and Linux. Fractureiser was found in many mods uploaded to CurseForge and BukkitDev.

## Accounts

Compromised accounts on said websites were used to inject malicious code into plugins and mods. Some of these malicious copies have been injected into popular modpacks, including Better Minecraft, which has over 4 million downloads.

## Payloads

Running an infected mod will trigger the infection chain and will compromise all other mods on the computer. On Windows, it adds a registry key so it can run at startup.

Fractureiser can:

* Self-propagate to all .jar files on the filesystem by injecting “Stage 0” (see "Infection Chain") into them,
* Steal cookies and account credentials stored on web browsers,
* Replace cryptocurrency wallet addresses copied in the system clipboard,
* Steal Microsoft and Discord account credentials,
* Steal Minecraft account credentials from a variety of launchers.

### Infection chain

Stage 0 is the initial attack vector; when infected mods are uploaded, or malicious code is injected into legit mods. When it's executed, it connects to a URL and downloads a file called dl.jar; which connects to another URL to get the IP address of the command-and-control server. A file is downloaded and creates a folder called "Microsoft Edge"; unlike the actual MicrosoftEdge folder, the fake one contains a space.

The malware will also download a file called lib.jar, which is configured to run at startup. Lib.jar will also download Client.jar, which is stage 3. Stage 3 creates folders, scripts, edits the registry, and steals information.

## Trivia

* One of the compromised accounts is named "Fractureiser"
Adware.InstallCore

Example of Adware InstallCore installer.

**Adware.InstallCore** is a detection name for a family of bundlers that installs more than one application on the user’s computer, usually by combining a popular title with one or more adware programs.

The developer behind InstallCore is ironSource, a company that builds monetization, engagement, analytics, and discovery tools for app developers, device manufacturers, mobile carriers, and advertisers. InstallCore is available for Windows and Mac systems.

## Type and source of infection

Adware.InstallCore are often served as updates for popular plug-ins like Java or Flash bundled with PUPs and adware.
Antivirus 2010

Antivirus 2010 Window

**Antivirus 2010** is a rogue antivirus; it pretends to scan the computer and tells the user they need to pay in order to "remove" the "detected viruses"

## Payloads

When run, it shows a message claiming that the user's computer is "making unauthorized copies of system and internet files". Clicking no will cause the rogue to repeatedly show notifications claiming the computer is infected. Clicking yes on the initial popup or on a notification will open a fake scanning window, it pretends to detect malware, and then tells the user they need to pay to "remove" them.

### Startup Payload

On startup, Antivirus 2010 displays a message saying " Security warning! Worm.Win32.NetSky detected on your machine. This virus is distributed via Internet through e-mail and Active-x objects. The worm has its own SMTP engine which means it gathers e-mails form your local computer and re-distributes itself. In worst cases worm can allow attacker to access your computer, stealing passwords and personal data. Viruses can damage your confidential data and work on your computer . To continue with unprotected mode is very dangerous. Type: Virus System Affected: Windows 2000, NT, ME, XP, Vista, 7 Security Risk (0-5): 5 Recommendations: It is necessary to perform a full system scanning."

### File Restriction Payload

After some time has passed, Antivirus 2010 will block every executable from running, and show a popup claiming that the program is infected. Though the user can dismiss the warning and start the program.

After more waiting it will show a fake network attack message.
Mega Antivirus 2012

Mega Antivirus 2012 interface

**Mega Antivirus 2012** is a rogue anti-spyware program that is promoted through the use of fake online anti-malware scanners. When browsing the web you may be brought to a page that displays an advertisement that pretends to be an online anti-malware scanner. When this advertisement is finished it will state that your computer is infected and that you should download and install Mega Antivirus 2012 in order to protect yourself.

Once downloaded the program will be configured to start automatically when Windows starts. Once started it will state that you are infected with numerous infections but will state that it won't remove any of them until you purchase the program. The program will also set various Windows Registry settings so that you will not be able to start the legitimate rundll32.exe program and the Windows task manager. While running, the program will also display a false security alert that contains the following message:

**Mega Antivirus 2012 Warning**

Mega Antivirus 2012 has detected some serious threats to your computer! Please remove these threats as soon as possible! You can so by clicking here.

Just like the fake scan results, this warning should be ignored.

Without a doubt, Mega Antivirus 2012 was created to scare you into thinking your computer has a security problem so that you will then purchase this program. For no reason should you purchase Mega Antivirus 2012, and if you already have, you should contact your credit card company and dispute the charges stating that the program is a computer infection.

**NOTE: Creating malware is illegal and can result in being prosecuted under applicable laws in your country. This page is for informational purposes only. Do not use this information for creating viruses.**
AdwCleaner

**This article is not about a piece or type of malware, it's about an anti-malware program.**
AdwCleaner is an Anti-Adware/Anti-Junkware program developed by Xplode development team. The user may scan the system for Shortcuts, Registry Keys and Malicious Browser extensions. It may also detect OEM bloatware such as Ebay links on the desktop. The latest version of this software is **v4.207.**
SoHedovoken

**NOTE: This Virus is Fictional.**

SoHedovoken is a multi-form computer virus disguised as a way to get free V-Bucks for Fortnite.

SoHedovoken's Info
 2021: 9.8 thousand
 2022: roughly 200 thousand

This virus would kill your computer if it were real.

It has the same effects as the WannaCry Ransomware but way worse. It's almost on the same level as Slammer.

### **The items listed below are it's extra info.**

SoHedovoken's extra info

k
e
r
d
e
# t
N
o
s
e
t
l
i
m
i
t
s
−
F
a
l
s
e
,
T
r
u
e
,
D
e
s
y
n
c
h
r
o
n
i
z
e
.
.
.
.

{\displaystyle kerdet=Nosetlimits-False,True,Desynchronize....}

(The code on the left is what the virus will do)

There will be a message that says "

Y
O
U
R
C
O
M
P
U
T
E
R
I
S
F
U
C
K
E
D
F
O
R
G
O
O
D
H
A
H
A

{\displaystyle YOURCOMPUTERISFUCKEDFORGOODHAHA}

" when completing the fake survey to get the "V-Bucks"

# SoHedovoken 2.0

**Just the previous versions of SoHedovoken but with worse viruses.**
Petya

**Petya** is an encryption extortion device that was first discovered in 2016. Petya attacks computers with the Windows operating system. This ransomware infects the MBR to display the ransom note instead of booting into the OS. In 2017, a new variant was discovered that uses the EternalBlue exploit.

## Payloads

When run, Petya will bluescreen the computer. When it starts back up, the malware shows a fake chkdsk screen while encrypting the master file table (MFT).

After the "chkdsk", the first variant shows a flashing ascii skull over a red background; however, NotPetya only shows the ransom note

## NotPetya variant

In 2017, a new variant called NotPetya was discovered. NotPetya uses the EternalBlue exploit to propagate.

~~This ransomware does not make a very good pet~~

## Arrested

**NOTE: Developing malware is illegal and can result in legal consequences and getting arrested. This page is for informational purposes only. Do not use this information to develop malicious programs.**
Malvertising

**This article is not about a piece or type of malware, it's about a way malware spreads.**

**Malvertising** is when online ads have malware in them. Some of them redirect the user to a malicious site when the ad is clicked. The word "malvertising" is a portmanteau of "malware" and "advertising".

## Types

There are many different ways people put malicious ads on websites, such as:

* Popup ads
* Drive-By-Downloads
* Malicous banners
* 3rd party ads

## Kinds of Campaigns

Some kinds of campaigns that malvertisers use include:

* Get-Rich-Quick Schemes
* Surveys
* Fake software updates
* "Scanners" that claim to detect bad things (such as malware or storage/hardware problems). These will often tell the user to install a program to get rid of them.

## Examples Gallery

These ads attempt to convince the user they have a virusThis one was displayed on a texting appMalvertisers really like the color red, don't they?This iOS ad claims the user's storage is fullThis ad was on YouTube