Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.



13 February 2007
Also Known As:

Lucky2000 is a very simple overwriting Visual Basic Script virus. The virus was written in Germany. When executed, this virus will simply overwrite all files in the same directory with the virus code.

Antivirus Protection Dates

  • Initial Rapid Release version 18 December 2000
  • Latest Rapid Release version 09 March 2011 revision 038
  • Initial Daily Certified version 18 December 2000
  • Latest Daily Certified version 09 March 2011 revision 039
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

This virus had never been found in the wild, and it is doubtful it will ever have wide distribution considering its replication mechanism.

The virus will, depending on a random algorithm, display the message:

It will also create the C:\WINDOWS\Favorites\Lucky2000.URL file as a shortcut to a Web site in Russia. This file is then executed so the page is displayed in your Web browser.
Writeup By: Eric Chien