x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Download Cloud Antivirus Gratis

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Tearec.A

Threat LevelHigh threatDamageSevereDistributionNot widespread
Common name:Tearec.A
Technical name:W32/Tearec.A.worm!CME-24
Threat level:Medium
Alias:Nyxem.D,, W32/MyWife.d@MM, W32/Mywife.D.worm, W32.Blackmal.D@mm, WORM_BLUEWORM.D
Type:Worm
Effects:  

It disables and ends certain antivirus programs. It also attempts to delete files belonging to several antivirus programs and P2P programs, among others. It spreads via email in a message with variable characteristics and across networks.

>
Affected platforms:

Windows XP/2000/NT/ME/98/95

First detected on:Jan. 16, 2006
Detection updated on:Feb. 23, 2010
StatisticsNo
Proactive protection:
Yes, using TruPrevent Technologies
Repair utility:Panda QuickRemover

Brief Description 

    

Tearec.A is a worm that disables and ends several antivirus programs, if they are installed on the affected computer. It also attempts to delete files belonging to several antivirus programs, peer-to-peer file sharing programs (P2P) and other Internet applications, which would make them stop working.

Additionally, it monitors the network traffic of certain connections related with antivirus programs and email services. This way, it could obtain passwords.

Tearec.A spreads via email in a message with variable characteristics and across computer networks.

 

On the 3rd of every month, Tearec.A overwrites all the files that contain any of the following extensions:
.DMP, .DOC, .MDB, .MDE, .PDF, .PPS, .PPT, .PSD, .RAR, .XLS and .ZIP.
overwriting them with the text string DATA Error [47 0F 94 93 F4 K5].

These extensions belong to the following types of file:
- .DMP: Windows memory dump.
- .DOC: Word documents.
- .MDB: Access database.
- .MDE: Access MDE database.
- .PDF: Acrobat Reader documents.
- .PPS: Power Point slideshows.
- .PPT: Power Point slideshows.
- .PSD: Photoshop images.
- .RAR: files compressed with WinRAR.
- .XLS: Excel documents.
- .ZIP: files compressed with WinZip.

Visible Symptoms 

    

Tearec.A is easy to recognize once it has affected the computer, as it shows the following symptoms:

  • If it detects an antivirus program installed, it displays the text Update Please wait in the Task bar.
  • If Tearec.A does not detect any antivirus program installed, it opens a compressed file called SAMPLE.ZIP, which is empty. Its aim is to mislead users and make them think it is only a damaged file.