Common Tasks

Recent Posts

Community

Email Notifications

Personal Links

Archives

Security Protection - Harry Waldron (CS)

Security Best Practices, Breaking News, & Updates

Rabb Worm - Destructive new worm affects EXE files

Most viruses are designed to hide on the system, however occasionally a destructive one will surface that will require restoration from backups or a complete rebuild of the PC environment.  This new virus is not widespread but folks should always be cautious on attachments and keep up-to-date on AV signatures.  

Rabb Worm - Destructive new worm
http://vil.nai.com/vil/content/v_141982.htm

W32/Rabb.worm is a destructive worm that overwrites and replaces executable *.EXE files. It can also make copies onto removable media and mounted network drives. As executable files are overwritten and not infected, affected *.EXE files cannot be repaired and must be restored from backup

A copy of Autorun.inf can be created at the root folder of each infected drive to automatically execute the worm. It may attempt to set the hidden bit in the attributes of these files. Executable files that had been replaced by W32/Rabb will bear an unusual icon (which looks like a rabbit)