Mandragore Virus on the Gnutella network…

Security firms are warning about a proof-of-concept Internet worm which tries to spread malicious files via the Gnutella peer-to-peer file sharing system.

The virus, called Gnutella Mandragore, will connect to the Gnutella network once it affects a users PC and will then attempt to offer itself for download when users search for songs or other files to download.

For example, if a Gnutella user makes a search for “Britney Spears swearing”, the infected node will announce it has available a file called “Britney Spears swearing.exe”, 8kB in size.

If a user downloads and clicks on this file, his machine becomes infected and will start to offer infected files for other users.

Infected nodes easily become overloaded and are unable to answer all requests. So every search does not find infected files although there are infected nodes in the network.