Type Mass mailer worm
Date Discovered 2001.08.17
Place of Origin
Source Language C++
Platform MS Windows
File Type(s) .exe
Infection Length 28,672 bytes
Reported Costs

All3gro sometimes also called Allgro or Atirus, is a nematode. It attempts to thwart the worms Sircam, Badtrans and Prettypark.


All3gro arrives in an email with a subject line of "New antivirus tool" and an attachment named "Antivirus.exe". The message body is "Hey, checkout this new antivirus tool which checks your system for viruses".

When All3gro is executed, it copies itself to the system folder as Setup30.exe. It adds this file as the registry value "Kernel Setup" to the local machine run key, ensuring it starts every time Windows does. The worm looks for email addresses stored on the system and uses Messaging Application Processing Interface (MAPI) commands to send emails with copies of itself.

All3gro searches for Sircam, Badtrans and Prettypark and tries to remove them. It also searches for and removes all .vbs, Mirc.ini and Script.ini files.


All3gro never became widespread. In spite of the fact that it actually did delete some files associated with certain worms, its claims to being antivirus software were dismissed as simply a social engineering tactic.


Peter Szor. Symantec, W32.Allgro@mm. 2007.02.13

John Leyden. The Register, Virus poses as antivirus utility. 2001.08.21

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License