The Tearec.A worm activates tomorrow

Madrid, February 2, 2006 - Tomorrow, February 3, the Tearec.A worm (also known as Nyxem.D, W32/MyWife.d@MM, W32/Mywife.D.worm, W32.Blackmal.D@mm and WORM_BLUEWORM.D) will carry out the action it was programmed for; delete files with the following extensions: .DMP, .DOC, .MDB, .MDE, .PDF, .PPS, .PPT, .PSD, .RAR, .XLS and .ZIP.

One of the most notable characteristic is its use of a counter on a web page to register the number of infections, which rapidly reached the millions. However, the accuracy of this counter has been called into question, and it has been estimated that, at the most, 300,000 computers could be infected with this code.

As reported by Panda Software on January 16, Tearec.A is easy to identify, as it shows the message ´Update Please wait´ in the taskbar if it detects an antivirus installed on the computer. If it does not detect any antivirus protection, it opens a file called ´SAMPLE.ZIP´, which does not show any content. The aim of this action is to trick the user into thinking that an error has occurred and therefore, slip past unnoticed.

TruPrevent(tm) Technologies can detect and block Tearec.A without the need for prior updates, so computers with these technologies installed (regardless of the antivirus solution) are protected. Panda Software also offers all users its free tool for deleting Tearec.A, which can scan computers and remove the danger of this worm deleting files tomorrow. This tool is available at: http://www.pandasoftware.com/download/utilities/.

Oxygen3 24h-365d
by Panda Software

2006-02-02 17:20

Back

IT News: