Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Gnuman

Win32/Gnuman is 8192 bytes long worm and spreads by means of the system for exchange Gnutella files.  Gnutella is a peer-to-peer network representing a sort of alternative to Napster.  With regard to the fact that this worm requires certain amount of cooperation from the user and that Gnutella users have obviously higher level of computer knowledge the chances of large-scale spreading of the worm are rather small.  Upon being run the worm creates a hidden system file Gspot.exe in the system directory from which applications are run at the start of Windows.  That ensures its activation at each Windows start.  The worm attaches itself as a knot to the network.  In Gnutella a part of the data is formed by search questions and answers to them.  The worm answers each question positively, if someone is searching to find for example words "Harry up Harry“ the worm answers that it has the file "Harry up Harry.exe".  Length of such a file is always 8192 bytes and it is a copy of the worm.  If someone decides to download that file and executes it, the infection takes place. There is the following text in the worm body:

[Gspot 1ß] freely shared by mandragore/29

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.