| Parrot | |
|---|---|
| Type | Multi-vector worm |
| Creator | Gigabyte |
| Date Discovered | 2001 |
| Place of Origin | Mechelen, Belgium |
| Source Language | Assembly |
| Platform | MS Windows |
| File Type(s) | .exe, .scr |
| Infection Length | |
Parrot, also known as Crackly, is a worm coded Gigabyte. It spreads in emails as a .scr file as well as through IRC. It also infects system files and when one is run, the virus runs an audio clip that says "Hello, I am Parrot, the talking virus, written by Gigabyte." It also plays a rude message about Sophos technology consultant Graham Cluley.
Behavior
Parrot can arrive on through email or an IRC channel. |
|
| Parrot's icon |
|---|
When Parrot is executed, it places a copy of itself named parrot.scr in the root of the C: drive.It also places the files msg.vbs, winstart.bat, parrot.scr, parrot.mp3 and hello.mp3 in the Windows directory. It creates the file script.ini in the folder where mIRC is installed. When the infected computer boots up, it plays the parrot.mp3 file, which says You're infected with Parrot, the talking virus, by Gigabyte/Metaphase.
It adds msg.vbs as a value of the local machine run once key and hello.mp3 as a value of the run key. Therefore the message runs once after infection and the hello file runs every time the computer starts, msg.vbs displays a message box with a rude message and hello.mp3 plays a spoken message with techno music in the background. The words heard in the .mp3 file are the same as those in the message box. Every time the system starts, it briefly displays the text:
Parrot has some viral characteristics, "infecting" executable files. It makes a copy of the original executable, but changes the extension to .prt. It then copies itself as the original file's name. When the infected user joins an IRC channel, it sends a copy to everyone logged on that channel.
Background
In 2001, Sophos senior technology consultant Graham Cluley referred to virus coders as spotty teenage nerds, drawing the ire of much of the community. One of the few female virus coders, a young woman from Belgium started a personal feud against Cluley. Parrot was the first in a series of worms and viruses either attacking Cluley or at least mentioning him. Others include Coconut and Quizy.
Sources
ESET Antivirus, Parrot.A
John Leyden. The Register, Sex starved virus writers go for revenge. 2001.08.03