W32.HLLW.Indor - Girls.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Indor

Sender:

Varies.

Subject:

Confirmation Email - Required !
Download DVD Movie Now !! Its Free..!
Free MP3, OGG/VORBIS Hit Songs !!
Free Software, Download it now !!
Need a quick $100 today?
Re: Your Daily Report
Re: Web Site Report
Thank You !
Thank You For Your Subscription - Confirmation
The E.A.S.E System Can Make You Money At Home!!
URGENT: Please Verify Your Submission Confirm FFA submission !!
WE send the TRAFFIC, YOU make the SALES!
WHY NOT CHECK IT OUT? IT'S FREE!
You are Losing Income
Your Success Is Guranteed!
Your verification is required Confirm FFA submission and receive 1000
Credit

Message:

ATTENTION: THIS PROGRAM IS EXPLODING WORLDWIDE. THOUSANDS OF PEOPLE
ARESIGNING UP EVERY DAY CREATING ONE OF THE LARGEST MEMBERSHIP BASES
IN THEWORLD!
Have I peaked your curiosity?This is something that I think that
anyone who is serious about marketing andbeing on the internet should
check out.Save it Now !
Hello!Need a quick $100 today?Need a quick $500 this week?Need to
QUICKLY build a $5,000 monthly income?Download the attachment now !
SPECIAL, SPECIAL ! SANTA CAME EARLY... WE WILL REFUND YOUR MONEY
IFYOU ARE AMONG THE NEXT 100 people to join, commit and bringyou new
people!Save it Now!
The Mastercard Stored Value Card is good anywhere in the world that
Mastercard is accepted! APPLY NOW AND GET $20 FREE!!Download it Now
And Get free Bonus!

Attachment:

The attachment, which is a zipped copy of the worm, is one of the
following:
Bonus.exe
Bonus.zip
FFA.zip
FFAMember.exe
Free.exe
FreeJoin.exe
FreeJoin.zip
Girls.exe
If you unzip the attachment, the unzipped file will be one of the
following:
ItsFree.exe
JoinNow.exe
Report.exe
Report.zip
SaveNow.exe
SaveNow.zip
Sexy.exe

Comments: A mass-mailing worm that uses Microsoft Outlook to send a zipped copy of itself to allthe contacts in the Microsoft Outlook Address Book. W32.HLLW.Indor.B@mm can also spreadthrough network drives, floppy disks, the KaZaA file-sharing network, and mIRC.

Symptoms:


 When run, it displays a fake message, stating Error in file #1: bad
Zip file offset (Error local header signature not found): disk #1
offset: 68669733". 
 Copies itself as: C:%Windir%Blank.scr and C:%Windir%Kernelw32.exe 
 Adds the value: Kernelw C:%Windir%Kernelw32.exe to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices so
that the worm runs when you start Windows. 
 Modifies the C:WindowsWin.ini file as follows: 
 In the windows] section, the worm adds the line: 
 load=C:%windir%Kernelw32.exe 
 so that it runs when you start Windows 95/98/Me. 
 Inserts the text: 
 [WORM] 
 Name=I-WORM>PERKASA 
 Author=Iwing/Indovirus 
 Modifies the [boot] section of the C:WindowsSystem.ini file, by
adding the line: 
 SCRNSAVE.EXE=C:%windir%Blank.scr 
 so that the worm runs when you start Windows 95/98/Me.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Indor.E@mm.
Remove the value that the worm added to the registry.
Windows 95/98/Me: Remove the lines added by the worm from Win.ini and System.ini files.