W32.Bokya.Int

W32.Bokya.Int is an intended worm that attempts to disguise itself as a pictures folder.

This threat is written in the Microsoft Visual Basic (VB) programming language and is compressed with UPX. Because this threat has been modified, it cannot be unpacked by UPX itself. The VB run-time libraries must be installed on the computer for it to execute.

NOTE: Symantec Security Response was not able to reproduce the replication behavior of this worm during testing in the antivirus lab. However, the threat contains code designed to spread itself to the root folder of all the drives.

Protection

• Initial Rapid Release version January 15, 2003
• Latest Rapid Release version July 12, 2008 revision 018
• Initial Daily Certified version January 15, 2003
• Latest Daily Certified version July 12, 2008 revision 019
• Initial Weekly Certified release date January 15, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low