W32.Assarm - Images.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Assarm

Sender:

Varies.

Subject:

Re: (original message subject line).

Message:

(infected computer's user name) wrote:===-(first line of original
message)-(second line of original message)...-((n-1)th line of
original message)-(nth line of original message)
(infected computers user's email address)followed by two lines of
Korean text; then:(infected computers user's email address)followed by
a line of Korean Text.

Attachment:

Bill.exe
Card.exe
Click.exe
Data.exe
Demo.exe
Docs.exe
Flash.exe
Fun.exe
Game.exe
Humor.exe
Images.exe
Mp3.exe
News_doc.exe
Opinion.exe
(One of 11 file names that contain Korean text.)

Comments: A mass-mailing worm that sends messages in reply to all unread messages in the Microsoft Outlook Mailbox. The email messages are not sent if the day of the week is Monday or Thursday and the hour of the time of day is greater than 5. For example, if the time is 4:00 A.M or 4:00 P.M., the message will be sent; if the time is 6:00 A.M or 6:00 P.M., it will not be sent.

Symptoms:


 Displays one of several messages, depending upon what day of the
week it is. If the day of the week is Thursday or Monday and the hour
of the day is greater than 5, the worm displays a message saying
"Korea Team Fighting".  Otherwise it will display a message saying
"FineArt ActiveX Control".

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Run a full system scan, and delete all files that are detected as W32.Assarm@mm.
On Windows 95/98/Me, remove the line "run=%windir%\svchost.exe"from the Win.ini file.