Discovered: May 04, 2004
Updated: May 04, 2004 5:21:22 PM
Systems Affected: Windows

W32.Arcam is a virus that infects Win32 portable executable files. It also attempts to spread through email and irc. The only know samples of this virus are corrupted, and do not successfully infect files or send email.

Discovered: May 04, 2004
Updated: May 04, 2004 5:21:22 PM
Systems Affected: Windows

W32.Arcam is a virus that infects Windows portable executable files. The virus attempts to infect PE files with .exe, .scr, and .cpl extensions files by appending a new section to the host file.

The virus creates a copy of itself as C:\secret.txt.exe.

It creates the file C:\plaeCBBNV.vbs. This is a VBScript file containing commands to email the worm to all addresses in the Outlook address book. The email would have the following form:

Subject: Test
Attachment: secret.txt.exe
Body: test

The virus also contains code to send secret.txt.exe to IRC users. It does this by adding a "dcc send" command to the mirc.ini file.

The only known sample of this virus is an infected host file that was corrupted in the process of infection. Windows does not successfully load or execute this file.