W32.Spreder

Discussion in 'NOD32 Early v2 Beta' started by spy1, May 31, 2003.

Thread Status:
Not open for further replies.
  1. spy1
    Offline

    spy1 Registered Member

  2. LowWaterMark
    Online

    LowWaterMark Administrator

    Off topic: Just an FYI, here is a link where someone is fighting this worm today:

    Edit: Since this was not a related thread, I have edited out the link to prevent any confusion.
  3. xor
    Offline

    xor Guest

    Just for info... Spreader is NOT a worm it's a virus.
    And the thread you point out mike refers to a worm. John did also missunderstand this - because he did post this virus info - this virus has nothing to do with this worm.

    Michael
  4. LowWaterMark
    Online

    LowWaterMark Administrator

    Hey Michael - thanks for the info! :)

    But, just to be clear... Are you saying these are two different pieces of malware (the one noted above, and the one in that other thread)? Or, did you mean some thing different?
  5. Longthing
    Offline

    Longthing Registered Member

  6. LowWaterMark
    Online

    LowWaterMark Administrator

    Ah, of course, now I see what happened. :rolleyes: Thanks!! ;)
  7. xor
    Offline

    xor Guest

    Spreader does infect *only* files in the Kazaa Folder - this means if you have there *.EXE or *.SCR Files this nasty writes itself to the top and appends the "normal" exefile. Kaspersky writes that the viruscode is around 60 kb and that a infected file can grow up to even 400kb - however i have here some files which are around 800 kb bigger after some GOAT-File infection tests.
    This virus is at least not dangerous, cuz he does not run (infecting) files if Kazaa is not installed. If Kazaa is installed it does only infect files in the Shared Kazaa Folder. I did receive many infections from GAV users - this "dumb" virus (he is really dumb) seems to spreading very well in the last 3 days over kazaa. He is very easy to detect even without a AV cuz he does create a logfile which files he did infect.
    it is only a guess from me that this is a "test balloon" and the "real" virus will follow soon.

    Michael
  8. jan
    Offline

    jan Former Eset Moderator

    Hi spy1,

    >http://www.viruslist.com/eng/viruslist.html?id=60322

    >You guys got this one?

    NOD is catching it - Win32/Reader.A worm .

    Cheers, :D

    jan
Thread Status:
Not open for further replies.