You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Panda Premium Assistance

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Clippo.A

Threat LevelLow threatDamageHighDistributionNot widespread

Effects 

Clippo.A puts a password to all the Office documents it finds in the computer and even in the removable drives, so that users cannot open them.

This way users will have to enter a password when they want to open Word or Excel documents, PowerPoint presentations or Outlook emails.

Unlike other similar malware samples, the purpose of this worm is not to obtain financial gains but just to annoy users, as it does not request any rescue for providing the password.

Clippo.A puts the same password to all the Office files and in the code of the worm it can be easily found, as can be seen in the image below:

Código de Clippo.A

The password, in a red square, is 721709031350.

Infection strategy 

Clippo.A creates the file FILM.EXE, in the root directory of the C: drive. This file is a copy of the worm and has the icon of a Windows folder:

Icon of Clippo.A

Additionally, it creates copies of itself with the names PICTURE.EXE and SOUND.EXEin the mapped and removable drives, and in the folders it finds.

 

On the other hand, it creates a script called 1.VBE in the root directory of the C: drive, which copies the Windows Registry entry it modifies to be run whenever the computer is started, as can be seen in the following image:

Content of the file 1.VBE

 

Clippo.A modifies the following entry from the Windows Registry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
    load

    It changes this entry to:
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
    load = c:\film.exe

    By modifying this entry, Clippo.A ensures that it is run whenever Windows is started.

Means of transmission 

Clippo.A spreads making copies of itself in the system drives, both removable and mapped drives. The names it uses to copy are PICTURE.EXE and SOUND.EXE.

Further Details  

Clippo.A is 86,016 bytes in size.

>

Technical Support

Panda Quick Start

Panda Quick Start

Let our experts install, activate, configure and customize your Panda's antivirus solution.
[+] info

Panda Remote Virus & Spyware Removal

Servicio de Asistencia de Desinfección

Let our experts access remotely to your PC, scan it and remove all viruses and spyware detected.
[+] info