W32.Cabreck


Aliases:  W32.Cabreck • Mcafee: W32/CableNet.worm • 
Variants: N/A

Classification: Malware
Category: Computer Worm

Status: dormant
Spreading: moderate
Geographical info: Europe, North and South America, and some parts of Asia and Australia
Removal: Easy
Platform: W32
Discovered: 17 Jun 2005
Damage: Low

Characteristics: The W32.Cabreck program looks for file sharing and network sharing loopholes.

More details about W32.Cabreck

The W32.Cabreck program uses shared network drives to multiply itself and spread. It also displays error message titled “winzip” and the body contains text saying “cannot open file: it does not appear to be a valid archive. If you downloaded this file, try downloading the file again. You may also a value, “"run" = "Cable.exe".” It also automatically creates Windows registry keys to make the worm run every time the Windows starts. You may also see the following files: FileCryptor.exe, Cable.exe, Microsoft SP4.exe, Acrobat Reader Setup.exe, NAI Mcafee.exe, Norton AV.exex, PGP Free.exe, Password recovery.exe, KazzaP2P.exe, Download accelerator.exe, Linux Source.exe, Winzip.exe, Lotus app.exe, Netscape.exe, Money Manger.exe, Paypal.exe, FixMydoom.exe, BillSux.exe, MorpheusP2P.exe,E_donkey.exe and Calvin and Hobbes.exe. These files can be seen in Windows folder, current folder or local shared folders.

Some files may also have a text body such as this: “Origin= India Type= Netwreck Worm Credicts= [Cable] By Gabe (Gabe Roq's Inc.) Warning= Amazing things will happen, you just wait...Note= Your Death is comming...Anticipation afterall is everything! SignNote= Because Death is only the beginning... Quote= For those who believe no explanation is necessary, for those who don't nothing will suffice.”