Mario Strikes!

A mass-mailing worm capitalising on the old Mario game reared its ugly head today in the form of W32/Romario-A.

Sadly aficionados of the Mario game would find themselves in bigger trouble than the much publicised icon of the genre.

When run W32/Romario-A not only runs a Mario game but also attempts to worm itself to other uninfected computers via mass-mailing itself as a file attachment as well as via removable shared drives.

The worm attempts to entrench itself by scheduling a task to ensure the worm runs every day at a specified time.

To further complicate matters, the worm is set to run when files with extensions of BAT, COM, PIF and SCR are opened/launched.

W32/Romario-A belongs to the list of malware pretending to be a game or to run a game. This trick has noticeably been tried many times before by previous malware authors. For example, the W32/Bagle-U worm attempts to start the Microsoft Hearts game (see related news article), the W32/Coconut-A virus starts a Coconut game and the Troj/Gonori-A Trojan plays Minesweeper when run.