Gokar-viruset; ingen god kar

Artikkelen fortsetter etter annonsen

annonsørinnhold

Ikke kast bort tiden på dårlige løsninger for videomøter

Gokar sprer seg via e-post, mIRC og web. Den sender seg selv videre til alle i Outlooks adressebok, oppretter et skript som benytter mIRC-klienten om den er installert på maskinen, samt leter etter inetpub\wwwroot-mappen, og kopierer seg dit som Web.exe. Dette er en IIS-folder (Microsoft IIS webserver). Den lager en ny default.htm-fil som viser frem teksten "We Are Forever". Enhver som laster inn denne siden vil bli bedt om å laste ned Web.exe-filen, skriver F-Secure.

Virus112 mener Gokar legger igjen en bakdør på maskinen, men ingen av de andre selskapene ser ut til å ha skrevet noe om dette.

Virusormen leveres med en av følgende tekster i emne-feltet:

If I were God and didn't belive in myself would it be blasphemy
The A-Team VS KnightRider ... who would win ?
Just one kiss, will make it better. just one kiss, and we will be
alright.
I can't help this longing, comfort me.
And I miss you most of all, my darling ...
... When autumn leaves start to fall
It's dark in here, you can feel it all around. The underground.
I will always be with you sometimes black sometimes white ...
.. and there's no need to be scared, you re always on my mind.
You just take a giant step, one step higher.
The air will hold you if you try, trust my wings of desire. Glory,
Glorified.......

Tekst:

Happy Birthday
Yeah ok, so it's not yours it's mine :)
The horizons lean forward, offering us space to place new steps of
change.
I like this calm, moments before the storm
Darling, when did you fall..when was it over ?
Will you meet me .... and we'll fly away ?!
You should like this, it could have been made for you
speak to you later
They say love is blind ... well, the attachment probably proves it.
Pretty good either way though, isn't it ?
still cause for a celebration though, check out the details I attached
This made me laugh
Got some more stuff to tell you later but I can't stop right now
so I'll email you later or give you a ring if thats ok ?!
Speak to you later

Den vedheftede filen kan komme med ett av følgende nummer:

tgfdfg jhfxvc cgfd2 trevc t6tr ffdasf glkfh fhjdv qesac kujzv weafs twat rewfd gfdsf hgbv fdsc p0olik 3tgf rf43dr t54refd ut545a r4354gkjw vgrewu
xw54re y343rv z3vdf

Og vedlegget virusormen lever i, lander i innboksen din med en av de følgende fil-endelsene:

.pif
.scr
.exe
.com
.bat