The following has been derived from information provided by F-Secure, NAI, Sophos, Symantec and Trend.

Virus Characteristics

GnutellaMandragore is a worm which spreads through the Gnutella peer-to-peer file sharing system (which is somewhat similar to Napster). If you're not using Gnutella, you're not at risk. Popular programs to access Gnutella include ToadNode and BearShare.

When it is executed, it opens port 99 on the computer. The worm will connect to the Gnutella network as one node. After that it will monitor what kind of files other people are searching for, and will answer those queries. The worm can change its own file name to match any query. However, the file size is always 8192 bytes, and it always has the extension .exe.

If the user downloads and clicks on this file, his machine becomes infected and will start to offer infected files for other users.

Infected nodes easily become overloaded and are unable to answer all requests. So every search does not find infected files although there are infected nodes in the network.

In some cases, infected files are offered without the EXE extension. Such files will fail to execute when doubleclicked but work fine if run from the commandline.

First infected files in the Gnutella network were spotted on Friday the 23rd of February, 2001.

An easy way to avoid infection from this worm is to not download EXE files from the Gnutella network. Some clients (such as BearShare) hide executable files from seach results by default.


Payload

Increased traffic on port 99 could lead to an instability of the system.


Preventative Measures

An easy way to avoid infection from this worm is not to download EXE files from the Gnutella network. Some clients (such as BearShare) hide executable files from seach results by default.

Block the default Gnutella port of 6346, and port 99, in both directions at the firewall.


Manual Removal

Use product specified definitions and run a complete scan deleting all files detected as infected.