New Virus?

[Soontir C'boath]

I just came home and started a scan on my comp. and found the w32/pate.a virus/worm whatever in my computer.... Just wondering if anyone knows about it and what it does....cause I just checked Norton and they didn't have it in their database.~Jason

[Crazy_Vasey]

http://securityresponse.symantec.com/av ... pinfi.html

[Faram]

Virus Profile
Virus Information
Name: W32/Pate.b.worm
Risk Assessment
- Home Users: Low
- Corporate Users: Low
Date Discovered: 10/15/2001
Date Added: 9/13/2002
Origin: Unknown
Length: 177kb
Type: Virus
SubType: Worm
DAT Required: 4167

Quick Links
Virus Family Statistics
Virus Characteristics
Indications of Infection
Method of Infection
Removal Instructions
Aliases
Buy or Update
New Users Get Protected Now:
Buy VirusScan
Update VirusScan
Virus Family Statistics (over the past 30 days)
Virus Name Infected Files Scanned Files % Infected Computers
Crepate.mp 0 0 0.00
Crepate.mp.1944 0 0 0.00
Crepate.mp.2910 0 0 0.00
W32/Pate 570 82,060 0.00
W32/Pate.a 1,871 1,519,569 0.00
W32/Pate.a.tmp 34 514,763 0.00
W32/Pate.b 2,122 197,573 0.00
W32/Pate.b.tmp 7 134,063 0.00
Virus Characteristics
This is an encrypted parasitic file-infecting virus and network aware worm. It appends PE EXE and SCR files in the Windows directory and subdirectories on the local system, as well as on any accessible network share. The virus creates an additional PE section with a random 3 letter section header followed by the character "•".

The virus creates the following registry key:

* HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\PINF

The virus may mis-infect files with an incomplete virus body. These damaged samples are detected as W32/Pate.b.dam, cannot be repaired, and should be deleted and restored from backup.
Indications of Infection
- Increase in file size by approximately 177Kb
- Presence of aforementioned registry key
Method of Infection
The virus drops a UPX packed executable in the WINDOWS TEMP directory and executes it. This file is 176,128 bytes in length, contains a random filename and a .TMP extension. The virus enumerates all network shares and infects all PE .EXE and .SCR files that it has write access to.
Removal Instructions
Use specified engine and DAT files for detection and removal.

Infected systems should be removed from the network and repaired prior to placing them back on to the network. Failure to do so can results in further infections.
As this threat seeks open shares, turn off full share to your system. If you have to use shares, use password protection to avoid being a future target.

Additional Windows ME/XP removal considerations
Aliases
PE_PARITE.A (Trend), W32.Pinfi (Symantec), W32/Parite-B (Sophos), W32/Parite.B (F-Prot), W32/Parite.B (Panda), W32/Pate.b.tmp, Win32.Parite.b (AVP), Win32.Pinfi.A (CA)

[Soontir C'boath]

Thank you so much.~Jason