New worm spotted by antivirus companies

Internet Business News, Dec 17, 2001

INTERNET BUSINESS NEWS-(C)1995-2001 M2 COMMUNICATIONS LTD

A new mass-mailing worm has been spotted spreading in the wild by antivirus firms Symantec, F-Secure and Trend Micro.

The new worm is called Gokar and spreads through Microsoft Outlook and Outlook Express e-mail clients when a user opens an attachment in an infected e-mail. The infected message is sent with dozens of combinations of different subject lines, body messages and filenames yet each attachment will end with '.pif', '.scr', '.exe', '.com' or '.bat' extensions.

Once opened, Gokar will attempt to install a file called Karen.exe on the infected system which mails itself to all of the addresses in a user's address book. This process is repeated each time the infected computer is booted up. The chat programme mIRC (Internet Relay Chat) may also be used to spread the virus in the same manner, should it be installed on the host computer.

Finally, the worm also causes any machine running Microsoft IIS (Internet Information Services) web server software to modify the default web page on the system to display the text "We are Forever" with a link to download a file called Web.exe which contains the Gokar worm.

((Comments on this story may be sent to info@m2.com))