WIN32/HLLO.HOMER - A NEW OVERWRITING VIRUS DETECTED

                     Win32/HLLO.Homer is a simple Windows based overwriting virus and it overwrites executable files [*.EXE] in the current folder. It needs "MSVBVM60.dll" to spread otherwise it will show DLL missing error. There are 4 more variants already detected but it is not reported in the wild. The infected files will show a red notepad icon.

                     When all files in the current folder are infected, it will display the message "SEBI I SAMO SEBI.......evo ti jedna informacija kao upgrade tvog znanja! JTM - from e[ax] to Homer Tha Pile" . The message window title will be ""...ispod se nalazi lista kome je Homer jebao mater!". The infected files can't be recovered, because it replaces the original file with virus code. So it should be restored from backup.

How can I protect my system?

Fire has incorporated Win32/HLLO.Homer and its variants in virus signature file, with the aim of helping users affected by this virus attack to detect and eliminate it from their systems. Fire anti-virus users can update this signature file by using online update facility.

How can I find my system is infected?

                   A free download of FireLite [ 1100KB ] version is available to detect all viruses. If you find any virus, use registered windows version of Fire to remove. To get the registered version of Fire call us at 044-28170440 or mail to service@fireav.com or purchase Fire online using

[Analysis: Mr.Stanley Rakesh, Mr.A.Xavier, Prognet Technologies Pvt. Ltd, Dec. 2000]