W32.Kotira


Aliases: PE_KOTIRA.A, Virus:Win32/Kotira.A, W32/VBTroj.EHX, Win32/VB.2.Z, Worm/Kotira.A.2
Variants: N/A

Classification: Malware
Category: Computer Virus

Status: Active & Spreading
Spreading: Slow
Geographical info: North America
Removal: Easy
Platform: W32
Discovered: 11 Apr 2004
Damage: Medium

Characteristics: W32.Kotira is a virus that copies the file atira.exe in a target computer. When the atira.exe process is running on your system, it is a sign that the virus called kotira has infected your computer. Atira.exe is considered a security risk and may cause a lot of performance problems.

More details about W32.Kotira

W32.Kotira is a virus that copies a file named atira.exe to a targeted computer. The virus copies itself as the following %System%\Arita.exe, %Windir%\Arita.exe, and C:\Program Files\Atira.exe. It adds the value "System"="C:\Progra~1\Atira.exe" to a certain registry key. It also attempts to create a new registry key. The virus overwrites executable files in the folders where the virus resides. It may also display the message “Your Computer already infected by Atira Worm+virus.” The Kotira Virus presents a serious vulnerability to the computer. If the file atira.exe is not removed at the soonest possible time, it may cause serious harm to the computer and may cause a number of problems. Some effects of the virus include slow computer performance, data loss, and even leaking of private information to websites.

The W32.Kotira program may be installed through bundling with a legitimate application such as a freeware or shareware. Other freeware may do this as well, but they state in their EULA that along with its installation is an installation of another application. But in the case of W32.Kotira program, its EULA reportedly does not state anything about its installation.