Aliases: W95/SchoolGirl.910, Win95.SchoolGirl.910
Variants: Win95/SchoolGirl.910, Virus.95.SchoolGirl

Classification: Malware
Category: Computer Virus

Status: Active & Spreading
Spreading: Slow
Geographical info: Asia, North and South America, and some parts of Europe and Australia
Removal: Easy
Platform: W32
Discovered: 04 Dec 2001
Damage: Medium

Characteristics: The W95/SchoolGirl.910 program is a Windows virus that duplicates only under Windows 95, Windows 98 and Windows Me. If it the virus activated under Windows NT, Windows 2000, and Windows XP, W95. SchoolGirl.910 does transfers control to the original host program.

More details about W95.SchoolGirl.910

This virus infects all .ocx, .scr and .exe files that it finds on the entire system (including mapped drives). Because of the way the virus infects files, it can corrupt or damage self extracting setup and executables programs such as InstallShield. This virus as well carries 2 payloads. First is the Payload one, this payload becomes active on every16th of the month. It just opens up your home page for Sichuan University of Science and Technology in China. Second is the Payload two, this payload is activated only if the day of the month is the 17th of year 2002 or later. Once this virus is activated, the payload deletes all .exe on all local drives and mapped drives.

This virus is quite destructive, mostly because of the bad programming. When W95.SchoolGirl.910 infects the file it can overwrite any appended or overlays data that belongs to the file host. The virus will most likely to corrupt set up programs and applications. Apart from the corruption capability, this virus usually increases the size of an infected file by around 910 bytes, but this block would almost always be filled with junk.