Threat Description

W-13

Details

Aliases: W-13
Category: Malware
Type: Virus
Platform: W32

Summary



This is a Vienna-derived virus, virus, but it marks infected files by setting the "month" field to 13, instead of setting the "seconds" field to 62. W-13 has been reported to have originated in Russia as well as in Poland.

A 507 bytes variant with some bugs corrected is also known.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details




Variant:Protector

CSSR 528, IKV 528

This East-European virus is related to the W-13 viruses, but it has not been fully analyzed yet.


Variant:W-13 C

This is a minor modification of the 507 byte variant mentioned above. It will set the "month" field to 12, which makes it less obvious, as 12 is a legal value, but this also makes all files created in December immune to infection.


Variant:REQ!

A 494 byte variant from Poland - Not yet analyzed.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More