W32.Campurf - Fc.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Campurf

Sender:

Varies.

Subject:

Some One Looking for you!

Message:

How to get a money in one days bussiness? The answer is inside the
attachment.

Attachment:

Fc.exe

Comments: A mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book. The worm terminates some antivirus and firewall processes and attempts to delete files associated with the registry

Symptoms:


 Adds the value fc (The current user's Application Data
folder>runfc.exe) to the registry key
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun 
 May copy itself to the Windows installation folder using one of the
following filenames: Bugbear solution.mpg, Estimate.mp4, Flash
animation.swf, Ghostreacon.avi, Hackers description.doc,
Happynewyear.jpg, HOW TO BLOCK AN EMAIL THAT CONTAIN A VIRUS.txt, Rice
and curry.mp3, Run in the sky.mov or What and who.gif 
 May set the value data of the Start Page of the value name in the
registry key, HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain
to http: vx.netlux.org~melhackerfc.exe.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Restart in Safe mode.
Run a full system scan, and delete all files that are detected as W32.Campurf@mm.
Delete the valuefc (current user's application data folder>\runfc.exe)from the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Reset your Internet Explorer Home page.