The HLLP/Scrambler.worm Virus

What is the Scrambler virus?

The Scrambler virus is a Trojan horse. It has a worm element and attempts to spread itself by sending e-mail to the first 90 addresses in the MAPI address book. The subject of the mail is "Check this out, it's funny!" . The mail includes an attachment, the name of which varies. If the attachment is opened, the virus will attempt to spread itself by e-mail and/or IRC. The virus may also affect the operation of some .exe and/or .mp3 files.

Where can I find more information about this virus?

Below are some links to information posted by others. While we believe this information may be useful and reasonably accurate, we have neither authenticated nor verified any of it.

F-Secure's Web site

See Symantec's Web site for current information on Norton AntiVirus updates and NAI's Web site for current information on McAfee VirusScan and Dr. Solomon's updates. You should use your regular update mechanisms to get the latest version of these virus definition files.

How can I remove this virus?

Follow the instructions found at the Web sites mentioned above, or contact the PCSC for help (353-7272, pcsc@bu.edu).

If you are affiliated with Boston University, you can download and install the latest version of Network Associates' McAfee VirusScan for free, as Boston University has a site license for this product. Please visit BU's anti-virus software Web site for more information. This site will prompt you for your BU login name and password before allowing access.

I received e-mail saying that a message I sent to someone at Boston University could not be delivered because my message might contain this virus. What should I do?

It appears that your system may be infected. As described above, the virus has probably used Outlook on your system to send infected e-mail to the addresses in your MAPI address book. To avoid sending this virus on to new recipients, you should download the appropriate virus definitions for your anti-virus product and then disconnect your computer from the network until you have completely removed the virus and protected your computer against re-infection.

Return to main virus information page