W32.Prolin.Worm(aka Creative)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Prolin.Worm

Sender:

Varies.  Usually someone who knows you.

Subject:

May say: A great shockwave flash movie.

Message:

Check out this new flash movie that I downloaded just now ... It's
Great Bye

Attachment:

Creative.exe

Comments: Emails all addresses in the Outlook address book andrenames .jpg, mp3, and zip files into C:\.

Symptoms:


 Creates a copy of itself with the name Creative.exe in the
C:WindowsStart MenuProgramsStartup folder. This will run the worm each
time you start Windows. 
 Copies the Messageforu.txt file to the root of drive C. The file
contains the text: Hi, guess you have got the message. I have kept a
list of files that I have infected under this. If you are smart enough
just reverse back the process. i could have done far better damage, i
could have even completely wiped your harddisk. Remember this is a
warning & get it sound and clear... - The Penguin 
 Moves all .mp3, .jpg, and .zip files to the root folder. It renames
each of these files and appends the following text to the extension of
each file: change atleast now to LINUX

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Find and delete all copies of the Creative.exe file.
Open an MS-DOS window and rename the files that were renamed by the worm back to theiroriginal extensions.
Move the files back to their original locations.