W32.Desperate - Diane.jpg.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Desperate

Sender:

Varies.

Subject:

Do you know a Diane ?

Message:

NA

Attachment:

Diane.jpg.exe

Comments: A worm that spreads by creating multiple files. It creates a Windows executable, an mIRC script, and a Visual Basic Script (VBS) file. The worm then uses these files to spread its infection using IRC and Microsoft Outlook

Symptoms:


 The worm consists of the following three main components, which are
contained in the VBS file: The IRC component is the mIRC script file
Script.ini, which is used to spread the worm using the IRC network.
The VBS component spreads the worm using Microsoft Outlook. It saves
the file as C:WindowsDiane.jpg  .vbs. The VBS file also contains the
IRC script and the executable file. So, when the worm spreads, it
sends the VBS file to other users. When the VBS file is executed, it
creates the IRC script and the executable file. The EXE component is a
backdoor Trojan. When this file is executed, it opens a backdoor on
the computer. 
 The worm also adds the following values to several registry keys:
SystemEvents     C:WINDOWSclhost.exe EXPLORER  
C:WINDOWS/system32/DRIVERS/EXPLORER.exe Winlogo   C:WINDOWSWinlogo.jpg
[many spaces] .exe WinHelp   wscript.exe C:WINDOWSDiane.jpg [many
spaces] .vbs % to the registry key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 It adds the value Window Title    to the registry key
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to make sure that you have the most recent virus definitions.
Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
Delete any files detected as W32.Desperate@mm, IRC.Desperate, or VBS.Desperate@mm
Undo the changes made to the registry.