W32.Navidad - Emanuel.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Navidad

Sender:

Varies. Usually someone who knows you.

Subject:

Uses existing subject lines.

Message:

Varies.

Attachment:

NAVIDAD.EXE
Emanuel.exe

Comments: A mass-mailing worm that replies to all inbox messages that contain a single attachment.

Symptoms:


 When executed, will display a dialogue box with the letters "UI" and
the title "Error". 
 If you are running Windows 95 or Windows 98, the worm adds the
following registry key: HKEY_USERS.DEFAULTSoftwareNavidad 
 If you are running Windows NT or Windows 2000, the worm adds the
following registry key: HKEY_CURRENT_USERSoftwareNavidad 
 If you are running Windows 95 or Windows 98, the worm adds the
following registry key: 
 HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with the value
Win32BaseServiceMOD=WindowsSystemWinsvrc.exe 
 If you are running Windows NT or Windows 2000, the worm adds the
following registry key: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
with the value Win32BaseServiceMOD=WinntSystem32Winsvrc.exe

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Copy Regedit.exe to Regedit.com (If you cannot start program files, or if you see themessage "Windows cannot find winsvrc.exe)
Edit the registry, and remove keys and changes made by the worm.
Set Windows to show all files.
Delete files placed on the computer by the worm.
Run a full system scan.