Virus Type: Mass mailing worms.
Affected OS: Win95/98/Me/2000/XP
Size: can be 25 352 byte, 17 424 byte, 24 840 byte, 22 016 byte, 18 944 byte, 31 232 byte
Packed by: can be packed by PETITE, PEPACK, PCPEC, UPX, PECOMPACT
C:\Windows\winlogon.exe -stealth ,
C:\Windows\MsnMsgrs.exe -alev ,
C:\Windows\fooding.exe –antivirus
into HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ of registry.
.cgi
.shtm
.msg
.oft
.sht
.dbx
.tbb
.adb
.doc
.wab
.asp
.uin
.rtf
.vbs
.html
.htm
.pl
.php
.txt
.eml
Lightwave SE Update.exe
Ulead Keygen.exe
Smashing the stack.rtf.exe
IE58.1 full setup.exe
Opera.exe
DivX 7.0 final.exe
WinAmp 12 full.exe
Cracks & Warez Archive.exe
Visual Studio Net Crack.exe
ACDSee 9.exe
MS Service Pack 5.exe
Clone DVD 5.exe
Magix Video Deluxe 4.exe
Star Office 8.exe
Partitionsmagic 9.0.exe
Gimp 1.5 Full with Key.exe
Norton Antivirus 2004.exe
Windows Sourcecode.doc.exe
Keygen 4 all appz.exe
3D Studio Max 3dsmax.exe
1000 Sex and more.rtf.exe
RFC Basics Full Edition.doc.exe
Dictionary English - France.doc.exe
Win Longhorn Beta.exe
WinXP eBook.doc.exe
Learn Programming.doc.exe
How to hack.doc.exe
Doom 3 Beta.exe
E-Book Archive.rtf.exe
Virii Sourcecode.scr
Ahead Nero 7.exe
Full album.mp3.pif
Screensaver.scr
Serials.txt.exe
Microsoft Office 2003 Crack.exe
XXX hardcore pic.jpg.exe
Dark Angels.pif
Porno Screensaver.scr
Best Matrix Screensaver.scr
Adobe Photoshop 9 full.exe
Adobe Premiere 9.exe
Teen Porn 16.jpg.pif
Microsoft WinXP Crack.exe
Your mail account has been closed. Click on the link for further details.
Your mail account has been deactivated. To reactivate, follow the link.
Mail account expired
Mail account closed
Mail account deactivated
Your file is attached.
Please read the attached file.
Please have a look at the attached file.
See the attached file for details.
Here is the file.
Your document is attached.
me veja peladinha
gostaria disso e voce???
algo a mais falea verdade!!!
ganhe muita grana
campanhadafome
pq nao me liga??
sinto voce!!
grana
Lembra? amor me liga
Hackers do Brasil
Medical Labs Exames!!!
meu telefone liga
ferias nos E.U.A
Surto :(
Vacina contra o HIV!!
sua conta bancaria zerada
olha que isso!!!
parabens!
te amo!
Policia SP
Sua Conta!!
Boleto Pague
veja o que tem no zip e me liga receitas de bolo!!
acrdito que em voce!!!
promocao de viajens de fim de ano
tudo sobre voce sabe
Proposta de emprego!!
estou doente veja!!!
me diz o queacha?
retorna logo isso!!
arquivo zipado PGP???
voce passou
:D!!!
ve ai logo ta
AMA!
AmaVoce
Abra rapido isso!!!!
reza de sao tome!!!!.
veja detalhes!!!.
encontro voce!
preenche ai ta bom
PizzaVeneza!
vaca
tetas
war3!
AIDS!
grana
banco!
revista lulao!
imposto jogo!
loterias
vips!
missao
vadias!
flipe
botao
sampa!!
contas!!
zerado
:(
criancas!
brasil!
lantrocidade
aqui
docs
festa!!
LINUSTOR
bingos!
agua!
:D
sorteado!!
grana!!
dinheiro!!
carros!
voce
:-)
???
circular
agradou
diga
robos!
impressao!!
massas!
pescaria por kilo
Sua saude esta bem? morto :)
your_product.pif
your_letter.pif
your_archive.pif
your_text.pif
your_bill.pif
your_details.pif
document_word.pif
document_excel.pif
my_details.pif
all_document.pif
application.pif
mp3music.pif
yours.pif
document_4351.pif
your_file.pif
message_details.pif
your_picture.pif
document_full.pif
message_part2.pif
document.pif
your_document.pif
vota!.zip.scr
aninha gatinha!.zip.scr
importante!!!!!.zip.scr
minhavida!.zip.exe
comoserrico!.zip.scr
vida!!.zip.scr
receitas de bolo!!.zip.scr
celulares!!.zip.scr
clica ai logo meu.scr
rede globo tv!.zip.scr
rocha.scr
paula!.scr
Carnaval em Salvador!!.zip.scr
vadias peladas!!.scr
cafe!!.zip.scr
traficoemSP!.scr
MulataDandoOcujpg.scr
multas.pif
caspa.scr
barrio.scr
ResidentEvil2.zip.scr
puteiros!!.scr
Canaval2004!.jpg.pif
VivaNaBaia!.scr
fbi
orton
f-pro
aspersky
cafee
orman
itdefender
f-secur
avp
spam
ymantec
antivi
icrosoft
iruslis
andasoftwa
skynet
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\KasperskyAV
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Taskmon
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\msgsvr32
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\service
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OLE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Sentry
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Services Host HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DELETE ME
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\au.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\d3dupdate.exe
HKLM\System\CurrentControlSet\Services\WksPatch
Hey Bagle, feel our revenge!
MyDoom and Bagle are spammer
we are the skynet - you can't hide yourself! - we kill malware writers (they have no chance!) - [LaMeRz-->]MyDoom.F is a thief of our idea! - -< SkyNet AV vs. Malware >- ->->
2. Scan computer with Dr.Web® Scanner or freeware utility Dr.Web® CureIT!. It's necessary to apply action "Cure" to all infected files which were found.
3. Recover system registry from backup copy.
Important! Directly before doing of item 2, it's necessary to adjust the used email client so that it stored attachments as separate files, instead of in a body of email base. For example, storage of attachments separately from email base in email client TheBat! is adjusted as follows:
Account - Properties - Files & Directories - Keep attachment files - Separately in a special directory.