Welcome to the Virus Encyclopedia of Panda Security.
|Effects: ||It renames files with a JPG, MP3 and ZIP extension.
|First detected on:|
|Detection updated on:||May 8, 2009|
|Yes, using TruPrevent Technologies
Prolin is a worm that spreads in an e-mail message with the subject A great Shockwave flash movie and an attached file called CREATIVE.EXE.
This files passes itself off as a Flash presentation, whereas it is actually a virus.
Prolin renames all the files it finds with a JPG, MP3 and ZIP extension. It also creates a file that contains a list of all the files infected by the worm. This text file invites the user of the affected computer to rename these files in order to recover their original content.
Prolin is easy to recognize, as:
- It reaches computers in an e-mail message with the subject A great Shockwave flash movie and an attached file called CREATIVE.EXE. This file has the icon that is typically associated with files created with the application Macromedia Flash.
- It moves the files it infects to the root directory. Therefore, files with an extension like MP3change at least now to LINUX indicate that Prolin has infected a computer.
- It sends an e-mail message to a Yahoo address. Therefore, a message in Outlook’s Outbox with the characteristics described below also indicates that Prolin has infected a computer:
Got yet another idiot