McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• I-Worm.Apbost.d (Kaspersky)

• PE_BOOSTAP.A

• W32.Appix.D.Worm (NAV)

Characteristics

This is a prepending virus that also attempts to propagate via email, mIRC Internet Relay Chat software and peer to peer file sharing software.

It may arrive in an email message that exploits the Microsoft Incorrect MIME Header vulnerability in Internet Explorer that allows the attachment to be run simply by viewing the email message.

When the virus is run, it copies itself to the WINDOWS directory as APPBOOST.EXE and creates registry keys to load itself each time .BAT, .CMD, .COM, .EXE, .PIF, and .SCR files are accessed.

Files of the above types can be prepended with the virus code. The virus may also append PHP files with code to serve the virus to users who access the PHP page through a webserver.

Under WinNT/2K/XP, a copy is saved to the %WinDir% directory as APPBSVC.EXE and it is registered as the service, "Application Boost Service".

A registry key is created to store information:

Symptoms

Method of Infection

This virus terminates running processes in order to try to bypass certain security products. It also tries to use the mIRC Internet Relay Chat software, peer to peer file sharing software and email to send itself.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• I-Worm.Apbost.d (Kaspersky)

• PE_BOOSTAP.A

• W32.Appix.D.Worm (NAV)

Characteristics

Characteristics -

This is a prepending virus that also attempts to propagate via email, mIRC Internet Relay Chat software and peer to peer file sharing software.

It may arrive in an email message that exploits the Microsoft Incorrect MIME Header vulnerability in Internet Explorer that allows the attachment to be run simply by viewing the email message.

When the virus is run, it copies itself to the WINDOWS directory as APPBOOST.EXE and creates registry keys to load itself each time .BAT, .CMD, .COM, .EXE, .PIF, and .SCR files are accessed.

Files of the above types can be prepended with the virus code. The virus may also append PHP files with code to serve the virus to users who access the PHP page through a webserver.

Under WinNT/2K/XP, a copy is saved to the %WinDir% directory as APPBSVC.EXE and it is registered as the service, "Application Boost Service".

A registry key is created to store information:

Symptoms

Symptoms -

Method of Infection

Method of Infection -

This virus terminates running processes in order to try to bypass certain security products. It also tries to use the mIRC Internet Relay Chat software, peer to peer file sharing software and email to send itself.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A