Norman Scanner Engine 5.83. 10
Sandbox 05.83, dated 13/00-2006

Your message ID (for later reference): 20060123-502

nepenthes-7b33550132b83ca17885d98ef7752fd6-windrv32.exe : [SANDBOX] infected with unknown worm - W32/P2PWorm (Signature: NO_VIRUS)
 [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * File length:        71680 bytes.

 [ Changes to filesystem ]
    * Creates file C:\WINDOWS\SYSTEM32\windrv32.exe.
    * Creates file C:\Progra~1\Kazaa\Myshar~1\2 Find MP3 8.2.0.exe.

 [ Spreading through P2P networks ]
    * P2P worm; drops files in P2P upload/download directory.

 [ Process/window information ]
    * Creates a mutex dvd.

 [ Signature Scanning ]
    * C:\WINDOWS\SYSTEM32\windrv32.exe (71680 bytes) : no signature detection.


(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

Sent by removed@email.com to sandbox.


Received 23.Jan 2006 at 12.35 - processed 23.Jan 2006 at 12.39.