New Virus Updates Itself

A new virus with the name of BAT.Ina.A is spreading via IRC, KaZaA and e-mail, which does not make it any different from many other viruses. On the contrary, the virus is capable of updating itself via a FTP-server.

The e-mail that it arrives with looks as follows:

Topic: hehe, isn't that fascinating...
Text: ... I just want to say something to the attachment: It is the first ever batch virus, that is able to update itself via the internet! Hehe, you don't have to execute it (if you don't want to , but if you understand a bit batch, look at it, it's really interesting!
Attached: BAT.INA.BAT

When the virus is executed, the necessary copying and change of files and registration keys takes place in order for the virus to be able to spread and executed when Windows starts. One of the copied files, FTP.TXT contains commands which allow for BAT.Ina.A to connect to a ftp-server, where an update of the virus is obtained.

The update (UPDATE.TXT), is renamed (UPDATECHECK.BAT), after being saved in the root of the C: drive and is executed. Execution of the update results in a number of mIRC, pIRCH and antivirus files being attempted deleted and the virus will then try to delete these files each time it is executed.

source: www.virus999.co.uk

wow that's scary... I hope I don't get one


I probably need to back everything up... but I'm really lazy

funkdamonkman said:

wow that's scary... I hope I don't get one


I probably need to back everything up... but I'm really lazy

Click to expand...

REAL MEN DON'T TAKE BACKUP

wow, that sounds like it wouldnt be good, and i use irc like everyday.... so i guess need to keep virus definitions up to date!

Or run linux. This virus doesn't affect linux.

if you have norton anti virus 2002 change your options in auto-protect to try to repair then quarantine if unsuccessful .do the same for manual scan. that way if nav2002 detects a virus it doesnt know how to repair it wont just leave it alone(this happens if you keep it at the defualt settings) itll just quarantine it and then you can submit it to symantec or just delete it from the quarantine

This isn't the first virus that did that... if I remember correctly, Happy99 (?) was a bit of script that downloaded an exe file & ran it w/o the user's consent.

Given that happy99 didn't check for updates, newly infected computers would get the updated version of the exe upon infection.

Cown said:

Topic: hehe, isn't that fascinating...
Text: ... I just want to say something to the attachment: It is the first ever batch virus, that is able to update itself via the internet! Hehe, you don't have to execute it (if you don't want to , but if you understand a bit batch, look at it, it's really interesting!
Attached: BAT.INA.BAT

Click to expand...

anyone STUPID enough to actually run that file deserves it.

im sympathetic to ignorant comp users (occasionally), but HEY DONT OPEN ME IM A VIRUS AND WILL DESTROY YOUR DATA is kind of hard to mistaken for not being a virus