Win32:Polip

Win32:Polip is memory resident polymorphic virus.

Win32:Polip spreads via Gnutella P2P networks. It makes a copy of itself in memory when an infected file is started. This resident part intercepts some API functions of the operating system and when these functions are called, new files get infected. It infects .EXE and .SCR files in Program Files and Windows System folders and also files in shared P2P folders.

Virus infects the files by writing its code to several places of the file. The virus also terminates processes of some antivirus and security programs, compromising the security of the system.

The virus works under Windows 98, ME, NT, 2000, XP and Server 2003 systems.

avast! with VPS file dated on or after 25th April 2006 is able to detect this worm.