GnutellaMandragore is a worm which spreads through the Gnutella
peer-to-peer file sharing system (which is somewhat similar to
Napster). If you're not using Gnutella, you're not at risk. Popular
programs to access Gnutella include ToadNode and BearShare.
When a PC gets infected, the worm will connect to the Gnutella network
as one node. After that it will monitor what kind of files other people
are searching for, and will answer those queries.
For example, if a Gnutella user makes search for "rare pictures of
butterflies", the infected node will announce it has available a
file called "rare pictures of butterflies.exe", 8kB in size.
If the user downloads and clicks on this file, his machine becomes
infected and will start to offer infected files for other users.
Infected nodes easily become overloaded and are unable to answer all
requests. So every search does not find infected files although there
are infected nodes in the network.
In some cases, infected files are offered without the EXE extension.
Such files will fail to execute when doubleclicked but work fine
if run from the commandline.
First infected files in the Gnutella network were spotted on Friday the
23rd of February, 2001.
An easy way to avoid infection from this worm is not to download EXE
files from the Gnutella network. Some clients (such as BearShare) hide
executable files from seach results by default.
