high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 11 May 2006 13:54:58 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Amire-A is a worm for the Windows platform.
W32/Amire-A spreads via file sharing on P2P networks.
When first run W32/Amire-A copies itself to <System>\svchot.exe.
The following registry entry is created to run svchot.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
amircivil
<System>\svchot.exe
The attempts to copy itself to the following locations, if the appropriate drive is present and writeable:
D:\SCREEN_SAVER.scr
E:\winx32.pif
F:\iran_02.scr
G:\anti_virus(norton).doc.cmd
C:\Program Files\Kazaa\My Shared Folder\CIVIL.exe
C:\Program Files\Kazaa\My Shared Folder\iraq.pic.scr
C:\Program Files\Kazaa\My Shared Folder\kaza.cmd
D:\Program Files\Kazaa\My Shared Folder\iran.pic.pif
D:\SCREEN_SAVER2.scr
E:\cool.pic.scr
F:\amir_civil3.scr
E:\amir_civil.scr
F:\iran.scr
D:\amir_civil.cmd
E:\002.pic.pif
G:\amir_civil.cmd
W32/Amire-A also copies itself to the file "project2.exe" in any folders whose path contains an "r".
W32/Amire-A attempts to use up all available memory and to shut down the infected computer.
|
