PE_TENGA.A

This virus spreads via network shares. It collects and generates a certain number of octets of a host machine's IP address, then scans the whole network for writable shared folders.

It either appends or inserts its code into the .EXE files it finds in all of the infected system's folders. This file infector executes at every system startup if the file it infects has autostart capabilities.

Upon execution, it connects to the following Web site to download DL.EXE, which Trend Micro detects as TROJ_TENGADL.A:

{BLOCKED}enti.lycos.it/vx9

The downloaded Trojan, in turn, downloads the file GAELICUM.EXE, which Trend Micro detects as PE_TENGA.A-O. Note that the file may vary anytime. As of this writing, the file is detected by Trend Micro as WORM_RBOT.GAE.

Related Items