W32/Mario-C is a worm for the Windows platform.
W32/Mario-C displays a fake error message with a title "Windows" and a window text of "File Corrupted, Re-install".
If terminated, W32/Mario-C may display a fake error message with a title "Unable to Terminate Process" and a window text of "This is a critical system process. Task manager cannot end this process" and will attempt to restart itself.
On the 12th of the month W32/Mario-C drops clean text files containing the following:
Firihenkulhi (Soasange) Natto.
Kudakudhin falha (Soasange) Natto
W32/Mario-C is a worm for the Windows platform.
W32/Mario-C copies the file Mario.exe, assuming this file to be a copy of itself, to C:\windows\system32\rund11.exe and sets the following registry entry to run this file on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Rund11
C:\windows\SYSTEM32\Rund11.EXE
W32/Mario-C periodically attempts to copy itself to A:\Mario.exe
W32/Mario-C displays a fake error message with a title "Windows" and a window text of "File Corrupted, Re-install".
If terminated, W32/Mario-C may display a fake error message with a title "Unable to Terminate Process" and a window text of "This is a critical system process. Task manager cannot end this process" and will attempt to restart itself.
On the 12th of the month W32/Mario-C writes
Firihenkulhi (Soasange) Natto.
Kudakudhin falha (Soasange) Natto
to the following files:
C:\FKnatto.txt
C:\Documents and Settings\All Users\Desktop\FKnatto.txt