McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

This is a floppy worm. It was detected as "New Floppy Worm" with heuristic scanning turned on.

When run, the worm copies itself to c:\WINDOWS\SYSTEM\W16OFF.exe. It creates the following registry key in order to run at Windows start up:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  "Spool32" = C:\WINDOWS\SYSTEM\W16OFF.exe

Every 2-3 minutes, the worm copies itself to floppy drive A:. It creates the following files:

• A:\command.com - the worm itself.
• c:\WINDOWS\SYSTEM\HTA.doc - word document.
• A:\TRAP.doc - same word document.
• c:\listf.vxd - a log file.

Symptoms

Existence of the files and registry keys mentioned above.

Method of Infection

The worm propagates via floppy disk.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

This is a floppy worm. It was detected as "New Floppy Worm" with heuristic scanning turned on.

When run, the worm copies itself to c:\WINDOWS\SYSTEM\W16OFF.exe. It creates the following registry key in order to run at Windows start up:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  "Spool32" = C:\WINDOWS\SYSTEM\W16OFF.exe

Every 2-3 minutes, the worm copies itself to floppy drive A:. It creates the following files:

• A:\command.com - the worm itself.
• c:\WINDOWS\SYSTEM\HTA.doc - word document.
• A:\TRAP.doc - same word document.
• c:\listf.vxd - a log file.

Symptoms

Symptoms -

Existence of the files and registry keys mentioned above.

Method of Infection

Method of Infection -

The worm propagates via floppy disk.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A