Gokar worm hits the web

Security software vendor F-Secure is warning businesses to be on their guard for a new worm called Gokar, which emerged this morning (13 December) and sends itself via Microsoft Outlook.

F-Secure said that the virus, written in visual basic, is a self-disguising mass mailing worm, and even attempts to deactivate antivirus software.

The worm uses different subject fields, contents and attachment names to send itself through Outlook. The attachment always has an extension of PIF, SCR, COM EXE or BAT.

An infected machine will have KAREN.EXE in the Windows directory, said F-Secure.

Once the worm has infected a PC the messages are various, and subject fields can include: 'If I were god and didn't believe in myself would it be blasphemy?', 'The A-Team VS KnightRider ... who would win?', and 'I like this calm, moments before the storm'.

Message bodies can read: 'You should like this, it could have been made for you, hey and speak to you later'.

F-Secure's dedicated team that searches for viruses on a daily basis is classing the virus as a level 2 risk. Instructions on how to remove the worm are available here.