Winfig (also known as Virus.Win32.Winfig) is a virus on Microsoft Windows, believed to originate from Brazil. Despite being written for operating systems like Windows 95, and 98, because of the way the payload works, it will have almost no effect on Windows ME.


The virus does not infect files, but when executed, it will check for a floppy drive, and if one is found, it will drop itself to the floppy drive. It then drops itself in the Windows file. Because it uses the folder icon, the user may be tricked into thinking it is just a system file. The virus then rewrites the .win file, so that it will be executed on boot. The payload itself however, only activates on October first. When the computer boots up on October 1st, it will change the background to green alien heads, with text in Portuguese.

After the text finishes, it will pop up with an error message also in Portuguese, saying that the user's computer has been infected with the "Carlos virus", and tells the user to reboot their computer, and then uses autoexec.bat to delete, which is required for boot on Windows operating systems. It also makes 316 folders in the system folder, which are all named "Mellisa & Carlos" following a number. However, these are completely empty folders.


Community content is available under CC-BY-SA unless otherwise noted.