Pentru amatorii de Quake!

A aparut un virus care face o gramada de pagube in cazul in care este executat! Acesta apare sub forma unui program de instalare care ar contine un demo de Quake!


W32.Eira.57344@mm is an Internet worm which carries a file-overwriting payload. The file name of this worm suggests that it is a demo of the Quake4 game, but it is not.

Alte denumiri:W32/Eira.A@mm, I-Worm.Quamo

Wild:

Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Easy

Damage:

Payload Trigger: Running the attachment, Windows startup
Payload: Overwriting .exe files
Large scale e-mailing: Yes
Deletes files: Yes
Modifies files: Yes
Degrades performance: Yes
Causes system instability: Yes

Distribution:

Subject of email: Varies
Name of attachment: Varies
Size of attachment: 57,344

Technical description:

This Internet worm has an icon resembling an installation program:[ http://www.symantec.com/avcenter/graphics/[email protected] - Pentru incarcare in pagina (embed) Click aici ]

When this worm is run, it displays the following Welcome box:
[ http://www.symantec.com/avcenter/graphics/[email protected] - Pentru incarcare in pagina (embed) Click aici ]

If you click Next, the worm does not do anything.
If you click Cancel, the worm is executed.
When the worm is executed, it does the following:

It copies itself to the Windows folder as:
Quake4demo.exe
Honey.exe
Setup.exe


Mai multe detalii gasiti la
Symantec