MSMVPS.COM

The Ultimate Destination for Blogs by Current and Former Microsoft Most Valuable Professionals.
Welcome to MSMVPS.COM Sign in | Help
in Search

Harry Waldron - Microsoft MVP Blog

Security News and Best Practices for corporate and home users

Rabb Worm - Destructive new worm affects EXE files

Most viruses are designed to hide on the system, however occasionally a destructive one will surface that will require restoration from backups or a complete rebuild of the PC environment.  This new virus is not widespread but folks should always be cautious on attachments and keep up-to-date on AV signatures.  

Rabb Worm - Destructive new worm
http://vil.nai.com/vil/content/v_141982.htm

W32/Rabb.worm is a destructive worm that overwrites and replaces executable *.EXE files. It can also make copies onto removable media and mounted network drives. As executable files are overwritten and not infected, affected *.EXE files cannot be repaired and must be restored from backup

A copy of Autorun.inf can be created at the root folder of each infected drive to automatically execute the worm. It may attempt to set the hidden bit in the attributes of these files. Executable files that had been replaced by W32/Rabb will bear an unusual icon (which looks like a rabbit)

Only published comments... Apr 12 2007, 07:56 PM by Harry Waldron

Leave a Comment

(required) 
(optional)
(required) 
Submit
Powered by Community Server (Commercial Edition), by Telligent Systems