Win32/Coke.22231.A was sent to several anti virus researchers at the end of May 1999.
Coke works on Windows 95 and 98 (its bugs will not let it work too long on Windows NT, but it is able to infect files under NT). The virus infects both Portable Executable applications and Office 97 documents and it is polyrmohic in both cases. Its first polymrophic decryptor is placed in the code section of the PE applications in 8 pieces similarly to the One_Half virus. Coke is slow polymorphic, multi-threaded and uses multi-layered polymorphism and encryption in PE applications.
The virus is able to mass mail itself to several locations. This can happen when the user sends a mail. The virus hooks a MAPI function and attaches an infected attachment to all out going mails from the machine. Additionally the virus sends a mail with an infected attachemnt each time when the user visites a web page which has a "mailto" reference. The virus keeps a CRC32 list in a file on the machine about the addresses it sent itself too. Therefore only one copy will be posted to each locations.
There is nothing really new in this virus, but the combinations of all these techniques makes it uniqe and very complex.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
N/A