It replaces gradually the folders of the different directories with a copy of itself and deletes the folders and files located in the affected folders. It spreads making copies of itself in the mapped, shared and removable drives.

Windows 2003/XP/2000/NT/ME/98/95

DirDel.A is a worm designed to replace gradually the folders of the different directories of the affected computer with a copy of itself which has the same name as the folders located in each directory. This way, if users run any of these folders again, DirDel.A will be run.

Additionally, it deletes the folders and files which are inside the replaced folders, causing an important loss of information for the user.

By using this technique, DirDel.A spreads through the affected computer. It also spreads through mapped, shared and removable drives, making copies of itself in them.

DirDel.A is easy to recognize, as it shows the following symptoms:

• It reaches the computer in a file called VENDETTA.EXE and has the icon of a Windows folder to deceive users:
  
  
• When it is run, it replaces gradually the folders of the directories of the affected computer with a copy of itself which have the same name as the folders of this directory, as you can see in the following images:
  
  Before the infection
  
  
  
  After the infection