WORM/GNUTELLAMAN - A P2P NETWORK WORM DETECTED

                     Worm/Gnutellaman is a network worm uses Gnutella peer-to-peer file sharing network to spread. The worm is a Win32 application with 8KB in size. Worm/Gnutella spreads using Gnutella network only. So there is not that much threat like e-mail worms.

                     When the worm file is executed the first time it will attempt to install itself as a service on a Windows NT/2000 machine or it will try to install itself in the "Startup" folder on a Windows 9X/ME machine.

                     Then the worm watches the Gnutella network and replies to every query posted.  For example, if you do a search consisting of "Love" the worm will return to your computer a result that matches your query exactly except that it is an executable file of [ Love.exe ] 8kBs.  If the user executed this file it will infect the local pc.

                     This worm is also known as Gnutella Mandragore, GnutellaMandragore, Mandragore, Gspot Trojan, W32.Gnuman.worm W32/GnutellaMan W32.Gspot.worm.

How can I protect my system?

Fire has incorporated Worm/Gnutellaman into its virus signature file, with the aim of helping users affected by this worm attack to detect and eliminate it from their systems. Fire anti-virus users can update this signature file by using online update facility. It is available with the registered version of Fire anti-virus Kit.

How can I find my system is infected?

A free download of FireLite [ 1100KB ] version is also available to detect all kinds of viruses including Gnutellaman worm. If you find this worm, use registered version of Fire to remove. To get the registered version of Fire call us at 044-28170440 or mail to service@fireav.com or purchase Fire online using

[Analysis: Mr.Surend Raj, Mr.Vijay Kumar, Prognet Technologies Pvt. Ltd, Feb. 2001]