W32.Fili - Freedom of expression.com

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Fili

Sender:

Varies.

Subject:

Important legal notice!
Please help us be free! We need the basic right of expression
Please help us to save the right of freedom of expression!

Message:


All details will be displayed in small attached file. Good luck
andthank you.
Do not delete this message. Analyse attachement and replyas soon as
possible with manifesto details.Thank you!
Enable an online vote for our manifesto with the help of the
attachement.Many thanks!
Its just hip-hop. Nothing else. Enjoy!
Its curious, its scandalous... dont be so furious!
Life is bitch so dont take it serious
Music is beeing censored, journalists are afraid, law has not
beenrespected for long time. Why? Because of corruption and lack of
right ofexpression. Help us! Enable the attachement and our voting
system willtrack and record you help. Many thanks!
Oh yeah! one more thing: its a censore-related manifesto :)
Parazitii need your help for the anti-censore campaign! See all
detailsin the attachement. Thank you!
Please help us be free! We need the basic right of expression.
This is my manifesto. You can stop this individual,but you can't stop
us all...after all,we're all alike.
We need you help now! Attachement will automatically send a vote to
ouronline database once you run it and will be redirected to our
webpage! ()
You personal manifesto details are attached. Take good care of them!

Attachment:


attachement.bat
attachement.cmd
attachement.com
attachement.exe
attachement.pif
attachement.scr
details.bat
details.cmd
details.com
details.exe
details.pif
details.scr
Freedom of expression.bat
Freedom of expression.cmd
Freedom of expression.com
Freedom of expression.exe
Freedom of expression.pif
Freedom of expression.scr
Government issue.bat
Government issue.cmd
Government issue.com
Government issue.exe
Government issue.pif
Government issue.scr
Manifesto anti pilif.bat
Manifesto anti pilif.cmd
Manifesto anti pilif.com
Manifesto anti pilif.exe
Manifesto anti pilif.pif
Manifesto anti pilif.scr
Manifesto details.bat
Manifesto details.cmd
Manifesto details.com
Manifesto details.exe
Manifesto details.pif
Manifesto details.scr
manifesto.bat
manifesto.cmd
manifesto.com
manifesto.exe
manifesto.pif
manifesto.scr
pilif.bat
pilif.cmd
pilif.com
pilif.exe
pilif.pif
pilif.scr
request.bat
request.cmd
request.com
request.exe
request.pif
request.scr
Simple solution.bat
Simple solution.cmd
Simple solution.com
Simple solution.exe
Simple solution.pif
Simple solution.scr
sustain cause.bat
sustain cause.cmd
sustain cause.com
sustain cause.exe
sustain cause.pif
sustain cause.scr

Comments: A generic Visual Basic worm that propagates via Microsoft Outlook and through peer-to-peerfile-sharing networks. It can also spread via mIRC.

Symptoms:


 Adds the value: "Pilif" = "%System%pilif.exe" to the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun so that
the worm runs when Windows starts. 
 Creates the following files: %System%adrbook mIRC folderManifesto
Anti Censore Pilif.txt.exe

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Fili@mm.
Delete the value that was added to the registry.