A standalone malicious program which uses computer or network resources to make complete copies of itself.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note You need administrative rights to change the settings.
There are two ways that this worm may arrive on a user's system: it may be delivered directly to the user in an infected email attachment, or the user may unknowingly download it from an infected website host.In the first method, the emails are sent out from other, infected machines. The worm's code is stored in a ZIP file attachment to the email. Each email will use one of these two sets of characteristics:
The worm may also be downloaded from an infected website host. If an infected machine is an IIS web server, the worm replaces the default index page at C:\Inetpub\wwwroot\index.htm with a page containing:
In both cases, running the extracted attachment or downloaded copy will launch the malware.
On execution, the worm will create a copy of itself.
It will also drop another malware file, detected as Trojan.Win32.Pakes.mmp.
It will then create registry entries so that the copy of the worm will run on system startup, as well as disabling the Windows Firewall.Next, the worm contacts this site to determine the infected system's IP address.
To propagate itself via infected emails, the worm harvests all email addresses stored on the infected system and sends out messages to all the harvested addresses. Each email contains the worm's code in an attachment, and the email itself will use one of the same two sets characteristics (subject line, attachment name, etc) as the email the worm arrived in.For the worm to propagate via downloads from a Web server, the infected system must first have Microsoft IIS installed. If so, the worm will create a copy of itself in the following location:
It will also create or replace the following file:
This new index page relies on social engineering to persuade visitors to download the malware.
Sets these values: