x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Simpsons

 
Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:Simpsons
Technical name:Trj/Simpsons
Threat level:Low
Type:Trojan
Effects:   It allows to get into the affected computer. It does not spread automatically using its own means.
Detection updated on:Nov. 13, 2002
StatisticsNo

Brief Description 

    
The program called Trojan/Simpsons is a highly destructive Win32 executable file, whose payload consists in deleting a large part of the files in drives C:, A:, B: and D:. This payload is triggered as soon as the program containing the malicious code is run.

Trojan/Simpsons is distributed in a self-extracting executable file of an unregistered version of the WinZip self-extractor (version 2.1). The file containing the Trojan has the classic self-extracting icon attached to it and has a size of 30,208 bytes.

On being run it self-extracts into a temporary folder, creating two files called SIMPSONS.BAT and SIMPSONS.BMP.

Visible Symptoms 

    

On being run it self-extracts into a temporary folder, creating two files called SIMPSONS.BAT and SIMPSONS.BMP.

The former is run immediately after the two files that have been extracted and, is actually an MS-DOS batch file including calls to the deletion programs of the MS-DOS DELTREE.EXE directories. With this it attempts to delete all folders and sub folders in alphabetical order of the C:, A:, B: and D: drives, in this order. Afterwards, it deletes itself to avoid leaving traces of its presence. This is a highly destructive Trojan that has the code to attack the drive from where it is executed along with all drives listed above in the order specified. Due to a design bug, this does not always happen, and the Trojan only manages to delete a part of the files on drive C:.

After the Trojan is run, the user sees an MS-DOS window similar to the one shown below:



In the dialog box that appears after clicking on the button About of the self-extractor, the following text in Spanish can be seen:

Dedicado a todos los que de una u otra forma pertenecen y amamantan a la maldita burocracia. El maldito capitalismo será nuestro final...