Besoin d’aide ? Fais appel à la communauté ou embauche un spécialiste.
Aller à Avira Answers
Size:11.780 Bytes 
Damage:Spreads over .JPG files.  
VDF Version: 

DistributionIt spreads over .JGP files, sent by the user.

Technical DetailsW32/Perrum is a Windows virus, which infects .JPG files. It is programmed in Visual Basic and packed with UPX.
The virus file PROOF.EXE drops two files: EXTRK.EXE and REG.MP3 in the same directory and enters the following registry key:

HKEY_CLASSES_ROOT\jpegfile\shell\open\command"(Default)"="EXTRK.EXE %1"

Then the worm checks for .JPG files in the same directory and infects them with its code. The code is inserted at the end of these files. A .JPG file can be infected only once and only one file per infection cycle is infected. When the infected file is opened from another infected computer, W32/Perrum searches for a clean .JPG file in the current directory and infects it with its virus code.

If the infected file is opened on a clean system, the virus code can not be activated.
W32/Perrum uses the following files:
PROOF.EXE = 11.780 Bytes (12Kbytes) (packed with UPX)
EXTRK.EXE = 5.636 Bytes (6 Kbytes) (extracting components)
REG.MP3 = Contains the registry key for W32/Perrum.
Description insérée par Crony Walker le mardi 15 juin 2004

Retour . . . .