McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

This detection is for a trojan generated using a perfectly legitimate commercial script interpreter (Hot Soup Processor). The trojan creates multiple large files (containing null data) in order to use up disk space.

When executed on the victim's machine, the following message box is displayed:

Subsequently, files (containing only nulls) of size 999,999 bytes are written to the current directory, until the disk is full. The filename used is 'NORTH KOREA DEATH!!.n' (where n = sequential integer).

Symptoms

Limited/no hard disk space coupled with files matching description above.

Method of Infection

When the trojan is executed on victim machine.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This detection is for a trojan generated using a perfectly legitimate commercial script interpreter (Hot Soup Processor). The trojan creates multiple large files (containing null data) in order to use up disk space.

When executed on the victim's machine, the following message box is displayed:

Subsequently, files (containing only nulls) of size 999,999 bytes are written to the current directory, until the disk is full. The filename used is 'NORTH KOREA DEATH!!.n' (where n = sequential integer).

Symptoms

Symptoms -

Limited/no hard disk space coupled with files matching description above.

Method of Infection

Method of Infection -

When the trojan is executed on victim machine.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A