McAfee > Theat Center > Virus Detail Page

Overview

Characteristics

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of an email HOAX.

This email message is just a HOAX, currently we know of no virus that affects computer hardware as the email states. AVERT has not received any report of a user's hard drive being destroyed as the email describes.

We are advising users who receive the email to delete it and DO NOT pass it on as this is how an email HOAX propagates.

Below is the actual text from the message that may be received via email.

(Portuguese version)

NOVO VIRUS DESTROI O HARDWAREUm novo vírus encontrado recentemente é capaz de queimar a CPU de algunscomputadores e mesmo causar danos a placa mãe. Sim, isto é verdadeiro,este vírus danifica o hardware do seu computador. O vírus, chamadow32.torch, usa o chip winbond w83781d, presente em muitas placas mãemodernas, e responsável por controlar a velocidade dos coolers de cpu esistema. A infecção acontece por meio da tão conhecida vulnerabilidadeda net-trap DCOM Microsoft, e quando instalado, o vírus se replica paraoutros computadores na rede local utilizando este método. Revertendo ocódigo do vírus, não encontramos evidências de outros códigos além doresponsável por queimar a cpu. O vírus desliga a detecção de altatemperatura na BIOS (que já vem normalmente desligada) e então diminuilentamente a velocidade dos coolers, levando o sistema a um mortalaumento de temperatura interna. Se Voce perceber que seu computador estáficando silencioso melhor verificar, porque ele pode estar parando, eVocê tem apenas alguns minutos para desligá-lo. O vírus contém o texto"Moscou Domina - out/27/03" que é mostrado no tray de algumas máquinas,baseado no seu endereço IP, talvez indicando sua origem soviética. Nãoexiste nenhum código preparado para ser ativado nesta data, mas pode serum indício de que algo está para acontecer neste dia. Alguns antivírusjá o detectam, verifique se o seu está atualizado.

(English version)

NEW VIRUS DESTROYS HARDWARE A new virus found recently is capable of burning the CPU of some computers and even causing damage to the motherboard. Yes, it's true, this virus damages the hardware of your computer. The virus, called w32.torch, uses the winbond w83781d chip, present in most modern motherboards, which is responsible for controlling the speed of the cpu and system fans. The infection takes place using the well-known Microsoft DCOM net-trap Vulnerability, and when installed, the virus spreads to other computers in the local network using this method. Reverse-engineering the virus code, we find no evidence of code other than that responsible for the CPU burnout. The virus turns off the high temperature detection in the BIOS (already disabled by default) and then slowly decreases the speed of the fans, leading the system to a deadly increase of the internal temperature. If You feel that your computer is becoming "quiet", it's better to check it out because it may be stopping, and you may have only a few minutes left to disconnect it. The virus contains the text "Moscow Dominates - out/27/03" which is shown in the tray of some machines based on their IP address, perhaps indicating Soviet origin. There is no payload set to activate on this date, but it may be an indication that something is supposed to happen on this day. Some antiviruses already detect it, check if yours is up to date.

Again, if you receive this email delete it and DO NOT pass it on.

McAfee AVERT

Symptoms

Method of Infection

Removal

Ignore or delete this email and do not forward it to others.

Variants

Variants

N/A

All Information

Overview -

Characteristics

Characteristics -

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of an email HOAX.

This email message is just a HOAX, currently we know of no virus that affects computer hardware as the email states. AVERT has not received any report of a user's hard drive being destroyed as the email describes.

We are advising users who receive the email to delete it and DO NOT pass it on as this is how an email HOAX propagates.

Below is the actual text from the message that may be received via email.

(Portuguese version)

NOVO VIRUS DESTROI O HARDWAREUm novo vírus encontrado recentemente é capaz de queimar a CPU de algunscomputadores e mesmo causar danos a placa mãe. Sim, isto é verdadeiro,este vírus danifica o hardware do seu computador. O vírus, chamadow32.torch, usa o chip winbond w83781d, presente em muitas placas mãemodernas, e responsável por controlar a velocidade dos coolers de cpu esistema. A infecção acontece por meio da tão conhecida vulnerabilidadeda net-trap DCOM Microsoft, e quando instalado, o vírus se replica paraoutros computadores na rede local utilizando este método. Revertendo ocódigo do vírus, não encontramos evidências de outros códigos além doresponsável por queimar a cpu. O vírus desliga a detecção de altatemperatura na BIOS (que já vem normalmente desligada) e então diminuilentamente a velocidade dos coolers, levando o sistema a um mortalaumento de temperatura interna. Se Voce perceber que seu computador estáficando silencioso melhor verificar, porque ele pode estar parando, eVocê tem apenas alguns minutos para desligá-lo. O vírus contém o texto"Moscou Domina - out/27/03" que é mostrado no tray de algumas máquinas,baseado no seu endereço IP, talvez indicando sua origem soviética. Nãoexiste nenhum código preparado para ser ativado nesta data, mas pode serum indício de que algo está para acontecer neste dia. Alguns antivírusjá o detectam, verifique se o seu está atualizado.

(English version)

NEW VIRUS DESTROYS HARDWARE A new virus found recently is capable of burning the CPU of some computers and even causing damage to the motherboard. Yes, it's true, this virus damages the hardware of your computer. The virus, called w32.torch, uses the winbond w83781d chip, present in most modern motherboards, which is responsible for controlling the speed of the cpu and system fans. The infection takes place using the well-known Microsoft DCOM net-trap Vulnerability, and when installed, the virus spreads to other computers in the local network using this method. Reverse-engineering the virus code, we find no evidence of code other than that responsible for the CPU burnout. The virus turns off the high temperature detection in the BIOS (already disabled by default) and then slowly decreases the speed of the fans, leading the system to a deadly increase of the internal temperature. If You feel that your computer is becoming "quiet", it's better to check it out because it may be stopping, and you may have only a few minutes left to disconnect it. The virus contains the text "Moscow Dominates - out/27/03" which is shown in the tray of some machines based on their IP address, perhaps indicating Soviet origin. There is no payload set to activate on this date, but it may be an indication that something is supposed to happen on this day. Some antiviruses already detect it, check if yours is up to date.

Again, if you receive this email delete it and DO NOT pass it on.

McAfee AVERT

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Ignore or delete this email and do not forward it to others.

Variants

Variants -

N/A