W32.Spreder

[spy1]

http://www.viruslist.com/eng/viruslist.html?id=60322

You guys got this one?

(It looks like a "preparatory" virus developed by the RIAA). Pete

[LowWaterMark]

Off topic: Just an FYI, here is a link where someone is fighting this worm today:

Edit: Since this was not a related thread, I have edited out the link to prevent any confusion.

Just for info... Spreader is NOT a worm it's a virus.
And the thread you point out mike refers to a worm. John did also missunderstand this - because he did post this virus info - this virus has nothing to do with this worm.

Michael

[LowWaterMark]

Hey Michael - thanks for the info!

But, just to be clear... Are you saying these are two different pieces of malware (the one noted above, and the one in that other thread)? Or, did you mean some thing different?

[Longthing]

The one in the other threat is Worm/SdDrop.A

Aliases: W32/Sddrop.worm, Worm.P2P.SdDrop.b, W32.HLLW.Kamesh, Worm/Sddrop

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDDROP.A

[LowWaterMark]

Ah, of course, now I see what happened. Thanks!!

Spreader does infect *only* files in the Kazaa Folder - this means if you have there *.EXE or *.SCR Files this nasty writes itself to the top and appends the "normal" exefile. Kaspersky writes that the viruscode is around 60 kb and that a infected file can grow up to even 400kb - however i have here some files which are around 800 kb bigger after some GOAT-File infection tests.
This virus is at least not dangerous, cuz he does not run (infecting) files if Kazaa is not installed. If Kazaa is installed it does only infect files in the Shared Kazaa Folder. I did receive many infections from GAV users - this "dumb" virus (he is really dumb) seems to spreading very well in the last 3 days over kazaa. He is very easy to detect even without a AV cuz he does create a logfile which files he did infect.
it is only a guess from me that this is a "test balloon" and the "real" virus will follow soon.

Michael

[jan]

Hi spy1,

>http://www.viruslist.com/eng/viruslist.html?id=60322

>You guys got this one?

NOD is catching it - Win32/Reader.A worm .

Cheers,

jan