Uploaded November 2012 | Updated September 2026, 2 weeks ago
Basically, it's very annoying worm. For some reason it doesn't attempt to spread itself through e-mail. I might have to configure mail server for that (which will never happen).
At first I'm showing that files are not infected at beginning, in case that you're suspicious.
So, Parrot worm drops few files: "parrot.scr" in root folder and "hello.mp3", "msg.vbs", "parrot.mp3" and "winstart.bat" in Windows folder. It will overwrite every EXE file in Windows folder only, with a copy of itself, but it will make backup under extension PRT. Additionally, worm adds 2 entries for startup: hello.mp3 (HKLM:Run) and msg.vbs (HKLM:RunOnce, for some reason not functional), but the result failed after reboot as instead of launching hello.mp3 and msg.vbs, all what you get is parrot.mp3 launched again and few screwups with SCANREGW as worm doesn't load extra command lines (it won't launch as SCANREGW.PRT /W, it will launch only as SCANREGW.PRT).
By running worm at any time, it will just open "parrot.mp3" and launch specific app (If you open any of "infected" executables, worm will just launch executable from PRT to make sure it does get launched). However, the mechanism of launching msg.vbs and hello.mp3 at startup is screwed. I had to recover RUNDLL32, SCANREGW and REGEDIT, then add msg.vbs at "Run" to make sure that worm does work as it should, at least how it was supposed to I think.
It's way too annoying to explain more of this as I've recorded this on my new laptop. My old PC got struck by thunderstorm 1-2 months ago.
Aliases:
Avast IRC:Parrot-B
AVG Win32/Parrot@mm
Avira WORM/Xanax
BitDefender Win32.Parrot.B@mm
F-PROT W32/Heuristic-114!Eldorado
F-Secure Email-Worm.Win32.Parrot.a
Ikarus Email-Worm.Win32.Parrot
Kaspersky Email-Worm.Win32.Parrot.a
vírusvédelem elnevezés
McAfee W32/Parrot.cmp.a(Virus)
NOD32 (ESET) Win32/Parrot.A
Microsoft Win32/Parrot.A@mm
Norton Antivirus W32.Crackly@mm
Panda W32/Parrot
Rising Antivirus Worm.Mail.Win32.Parrot.a
Sophos W32/Parrot-A
Trend Micro WORM_Generic
Basically, it's very annoying worm. For some reason it doesn't attempt to spread itself through e-mail. I might have to configure mail server for that (which will never happen).
At first I'm showing that files are not infected at beginning, in case that you're suspicious.
So, Parrot worm drops few files: "parrot.scr" in root folder and "hello.mp3", "msg.vbs", "parrot.mp3" and "winstart.bat" in Windows folder. It will overwrite every EXE file in Windows folder only, with a copy of itself, but it will make backup under extension PRT. Additionally, worm adds 2 entries for startup: hello.mp3 (HKLM:Run) and msg.vbs (HKLM:RunOnce, for some reason not functional), but the result failed after reboot as instead of launching hello.mp3 and msg.vbs, all what you get is parrot.mp3 launched again and few screwups with SCANREGW as worm doesn't load extra command lines (it won't launch as SCANREGW.PRT /W, it will launch only as SCANREGW.PRT).
By running worm at any time, it will just open "parrot.mp3" and launch specific app (If you open any of "infected" executables, worm will just launch executable from PRT to make sure it does get launched). However, the mechanism of launching msg.vbs and hello.mp3 at startup is screwed. I had to recover RUNDLL32, SCANREGW and REGEDIT, then add msg.vbs at "Run" to make sure that worm does work as it should, at least how it was supposed to I think.
It's way too annoying to explain more of this as I've recorded this on my new laptop. My old PC got struck by thunderstorm 1-2 months ago.
Aliases:
Avast IRC:Parrot-B
AVG Win32/Parrot@mm
Avira WORM/Xanax
BitDefender Win32.Parrot.B@mm
F-PROT W32/Heuristic-114!Eldorado
F-Secure Email-Worm.Win32.Parrot.a
Ikarus Email-Worm.Win32.Parrot
Kaspersky Email-Worm.Win32.Parrot.a
vírusvédelem elnevezés
McAfee W32/Parrot.cmp.a(Virus)
NOD32 (ESET) Win32/Parrot.A
Microsoft Win32/Parrot.A@mm
Norton Antivirus W32.Crackly@mm
Panda W32/Parrot
Rising Antivirus Worm.Mail.Win32.Parrot.a
Sophos W32/Parrot-A
Trend Micro WORM_Generic
