W32.HLLW.Tang - EmailHacker.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Tang

Sender:

Varies.  Usually someone who knows you.

Subject:

A ScreenSaver
Email spoofer
Hotmail passwords
Important Notice
Mp3 sites
Password Cracker

Message:

Hello all,Take a look at this email spoofer that I have included in
the attachments. An email spoofer is a program that lets you email
from anyone@anything.com!it's really fun to use for pranks :)Have
fun!
Hello readers,A few days ago the Microsoft Network Email System
automatically deleted my email account. This happened because there
is a bug in the Microsoft NetworkEmail System that may
unintentionally remove email accounts without prompting. I have
included a patch with this email that will fix the bug on un-patched
computers. If you need help installing this file, read attached help
file.Thanks.
Hello Everyone,I have a cool Password Cracker for you in the
attachments :) this Password Cracker can crack almost any password
out there!Try it for yorself!Cya!
Hello everyone,I found a really funny ScreenSaver on the net
yesterday and I think that you would find it funny like I did :) It's
in the attachments.Cya!
Hello Readers,Have you tried to crack a Hotmail password ... and
failed? Try the 'Hotmail Password Cracker' program that I have
included in the attachments.Happy hacking!
Hello,Try this new software that can download practically any .mp3
file that is found on the internet. I use this program all the time
and I think it's great!Have fun!

Attachment:

EmailFix.exe
EmailGen.exe
EmailHacker.exe
Hilarious.scr
Mp3Connect.exe
PswdCrack.exe

Comments: A mass-mailing worm that emails itself to all the contacts in the Windows Address Book.It also attempts to spread itself through the file-sharing networks, IRC, Microsoft WordDocuments, Microsoft Excel Spreadsheets and across mapped drives.

Symptoms:


 Displays the following fake message, if the %System%MSTng32.exe file
does not exist on the computer: (filename) is not a valid Win32
application NOTE: (filename) is the full path and file name of the
worm that was executed. 
 Attempts to copy itself as some of the following files: License.exe,
%Windir%EmailFix.exe, %Windir%EmailGen.exe, %Windir%EmailHacker.exe,
%Windir%Hilarious.scr, %Windir%Keymapp32.exe, %Windir%Mp3Connect.exe
and %Windir%Msdnssrv.exe among others where %Windir% is the original
installation directory. 
 The worm appends the following line to the end of each .bat file it
finds: @if exist %system%MSTng32.exe @win %systemMSTng32.exe 
 Adds the value: Mstng32             %system%MSTng32.exe to the
registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 Creates the registry key:
HKEY_USERS.DEFAULTSoftwareZed/[rRlf]Win32/TaNG and sets the default
value of this key to: W32/TaNG by Zed/[rRlf] 
 Adds the values: AccessVBOM 1 and Level 1 to the registry keys:
HKEY_CURRENT_USERSoftwareMicrosoftOfficeWordSecurity and
HKEY_CURRENT_USERSoftwareMicrosoftOfficeExcelSecurity 
 Turns off the following options: Microsoft Macro Virus Protection,
Save Normal Prompt and Confirm Conversions 
 Infects the Microsoft Word Normal.dot template.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Run a full system scan.
Remove the text that the worm added to all the .bat files detected as W32.HLLW.Tang@mm.
Delete all the files, other than the .bat files, detected as W32.HLLW.Tang@mm.