Don't call �911'. "Firkin" will do it for you!

02 Apr 2000
Virus News

A new dangerous worm calls �911' and destroys data on your PC!

Cambridge, UK, April 3, 2000 - Kaspersky Lab Int., a fast-growing international anti-virus software development company, warns about the discovery of a new set of network worms from the Worm.Firkin family. The worm has been reported "in-the-wild" and poses a real threat to the computer users. Detection and disinfection for this worm has been added to Kaspersky Lab's AntiViral Toolkit Pro (AVP).

General Characteristics
The worms which spread via the local network, appeared at the end of March - beginning of April 2000. They are also known as the "911 virus" because of its payload routine and mass-media attention caused by public announces made in beginning of April 2000.

Worm.Firkin is written in DOS Batch language (BAT files) and use DOS box commands and only a few external utilities to replicate via the Internet. It is a multi-component worm - comprising of not just a single file, but a set of DOS batch files, PIF files (program information file) and some additional files.

Infection Indication
The easiest way to detect infection by Worm.Firkin is to check the locations mentioned above to see if there are worm's files.
Prevention and Removal

In order to prevent infection with Worm.Firkin users must be very careful sharing resources with other users. Check to see if other users have full access to your root folder or Windows folder. You can do so in Windows 95/98 by opening Network Neighborhood and clicking on your computer's name. If you are not familiar with this you should contact your system administrator.

To remove the worm from an infected computer update the AVP anti-virus database with the latest daily update and scan all drives. AVP will effectively detect and neutralise Firkin.Worm.

More technical details