Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Spreads over .JPG files.
It spreads over .JGP files, sent by the user.
W32/Perrum is a Windows virus, which infects .JPG files. It is programmed in Visual Basic and packed with UPX.
The virus file PROOF.EXE drops two files: EXTRK.EXE and REG.MP3 in the same directory and enters the following registry key:
Then the worm checks for .JPG files in the same directory and infects them with its code. The code is inserted at the end of these files. A .JPG file can be infected only once and only one file per infection cycle is infected. When the infected file is opened from another infected computer, W32/Perrum searches for a clean .JPG file in the current directory and infects it with its virus code.
If the infected file is opened on a clean system, the virus code can not be activated.
W32/Perrum uses the following files:
PROOF.EXE = 11.780 Bytes (12Kbytes) (packed with UPX)
EXTRK.EXE = 5.636 Bytes (6 Kbytes) (extracting components)
REG.MP3 = Contains the registry key for W32/Perrum.
Description inserted by Crony Walker on Tuesday, June 15, 2004