Win32:Prolin

is another Internet worm. It spreads itself as an attachment called CREATIVE.EXE to the e-mail message with the subject "A great Shockwave flash movie". The message says: Check out this new flash movie that I downloaded just now...It's Great, Bye When executed, the program CREATIVE.EXE copies itself in the root of the disk C: and sends itself to all items from the Microsoft Outlook address book. It sends also another message to the Yahoo free email address with the text "Got yet another idiot" and the subject "Job complete". Win32:Prolin then searches all files with the extension MP3, JPG and ZIP, moves them to the root directory of the disk C: and renames them so that the extension is extended to "XXXchange at least now to Linux" where XXX is the original extension mentioned above. There is a special file created by the virus which is called "Messageforu.txt" which contains the short message about the infection (signed by "The Penguin") and also the list of all moved/renamed files. Removal: Delete the worm (CREATIVE.EXE file) and move all renamed files to their original locations. Don't forget to change their extension part of the name back. Any avast! with VPS file dated after 24th November 2000 is able to detect this virus.