Mandragore
Summary
GnutellaMandragore is a worm which spreads through the Gnutella peer-to-peer file sharing system (which is somewhat similar to Napster). If you're not using Gnutella, you're not at risk. Popular programs to access Gnutella include ToadNode and BearShare.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
When a PC gets infected, the worm will connect to the Gnutella network as one node. After that it will monitor what kind of files other people are searching for, and will answer those queries.
For example, if a Gnutella user makes search for "rare pictures of butterflies", the infected node will announce it has available a file called "rare pictures of butterflies.exe", 8kB in size.
If the user downloads and clicks on this file, his machine becomes infected and will start to offer infected files for other users.
Infected nodes easily become overloaded and are unable to answer all requests. So every search does not find infected files although there are infected nodes in the network.
In some cases, infected files are offered without the EXE extension. Such files will fail to execute when doubleclicked but work fine if run from the commandline.
First infected files in the Gnutella network were spotted on Friday the 23rd of February, 2001.
An easy way to avoid infection from this worm is not to download EXE files from the Gnutella network. Some clients (such as BearShare) hide executable files from seach results by default.
For more information, see:
https://www.exocortex.org/gnutella/
F-Secure Anti-Virus detects this virus since Tuesday, 27th of February. The updates are available on our web site:
USA:
https://www.f-secure.com/download-purchase/updates.shtml
Europe:
https://www.europe.f-secure.com/download-purchase/updates.shtml
[Mikko Hypponen, F-Secure Corporation, Feb 27, 2001]