W32.Mantibe is a virus that attempts to spread itself through floppy disks. The existence of the file C:\w12.txt is an indication of a possible infection. This threat is written in the Microsoft Visual Basic programming language.

Type: Virus
Infection Length: 57,603 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected: Linux, Macintosh, OS/2, UNIX

THREAT ASSESSMENT

Wild:

Number of infections: 0 - 49
Number of sites: 0 - 2
Geographical distribution: Low
Threat containment: Easy
Removal: Easy

TECHNICAL DETAILS

When W32.Mantibe runs, it does the following:


Displays a graphic the first time that it runs.


Copies itself to the %System% folder using the same file name as that of the executed file.

NOTE: %System% is a variable. The virus locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Copies itself as A:\Beso.jpg.exe.


Adds the following value:

"Mantis"="%System%\<the file name of the virus copy>

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the virus runs each time you start Windows.


May create two temp files:
C:\Ascii.txt
C:\w12.txt

These two files are not viral by themselves. Therefore, Symantec antivirus products do not detect them. You can manually delete them if found.
For complete details visit:
http://securityresponse.symantec.com...2.mantibe.html

Cheers,
BD]Hobbit