W32.Wonna - Interesting.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Wonna

Sender:

Varies.

Subject:

One of the following:
Check this out!
How are you??
Need help!
RE: Why you not replying??
We need to talk...!
What's happening???
What's the problem?
Why are you so
You need help?
followed by one of these:
angry at me??
Funny
hateful???
playful??
sad?
useless??
followed by one of these:
Application for you...
Document for you...
Joke for you...
Program for you...
Song for you...
TextFile for you...
Thing for you...
Tip for you...
Tool for you...
Website for you...

Message:

I tried to reach you at MSN Messenger but you weren't online! I got
something 'really'important to tell you! Check the attached file
(You'll find what I wanted to tell you there!)Ok. Reply as soon as
possible!Bye!
I need your help! I'm in a very difficault position right now. I
can't decide how good the file is from rate 0 To 5! I need your
opinion on it, so check it out (It's attached to this message!) and
tell me what you think from rate 0 To 5!Bye!
Where have you been all the time??? I tried to call you but you
weren't home! Anyway, see the attached file! It's important!Bye.
Why are you so angry at me? What have I done to you?? I only want you
to check this file out; It describes my opinion about you. Please
check it, you won 't be dissapointed ;) Hope to hear from you soon
:)Bye!
You said you needed help huh? Well I got the solution for your
problem! Just open the attached file and see what's in it ;)Bye!

Attachment:


Cool_File.asp
Cool_File.com
Cool_File.doc
Cool_File.exe
Cool_File.htm
Cool_File.jpg
Cool_File.mp3
Cool_File.mpg
Cool_File.php
Cool_File.txt
Funny.asp
Funny.com
Funny.doc
Funny.exe
Funny.htm
Funny.jpg
Funny.mp3
Funny.mpg
Funny.php
Funny.txt
FunnyClip.asp
FunnyClip.com
FunnyClip.doc
FunnyClip.exe
FunnyClip.htm
FunnyClip.jpg
FunnyClip.mp3
FunnyClip.mpg
FunnyClip.php
FunnyClip.txt
FunnyToy.asp
FunnyToy.com
FunnyToy.doc
FunnyToy.exe
FunnyToy.htm
FunnyToy.jpg
FunnyToy.mp3
FunnyToy.mpg
FunnyToy.php
FunnyToy.txt
Information.asp
Information.com
Information.doc
Information.exe
Information.htm
Information.jpg
Information.mp3
Information.mpg
Information.php
Information.txt
Interesting.asp
Interesting.com
Interesting.doc
Interesting.exe
Interesting.htm
Interesting.jpg
Interesting.mp3
Interesting.mpg
Interesting.php
Interesting.txt
Nice_File.asp
Nice_File.com
Nice_File.doc
Nice_File.exe
Nice_File.htm
Nice_File.jpg
Nice_File.mp3
Nice_File.mpg
Nice_File.php
Nice_File.txt
Nice_Song.asp
Nice_Song.com
Nice_Song.doc
Nice_Song.exe
Nice_Song.htm
Nice_Song.jpg
Nice_Song.mp3
Nice_Song.mpg
Nice_Song.php
Nice_Song.txt
Nice Tool.asp
Nice Tool.com
Nice Tool.doc
Nice Tool.exe
Nice Tool.htm
Nice Tool.jpg
Nice Tool.mp3
Nice Tool.mpg
Nice Tool.php
Nice Tool.txt
Readme.asp
Readme.com
Readme.doc
Readme.exe
Readme.htm
Readme.jpg
Readme.mp3
Readme.mpg
Readme.php
Readme.txt

Comments: A mass-mailing worm that sends itself to all contacts in the Microsoft Outlook Address Book.

Symptoms:


 Copies itself as a hidden, read-only file named C:Cool_File.exe. 
 Creates a Script.ini file, which sends C:Cool_File.exe using the
mIRC chat program. 
 Finally, the worm copies itself to either of these locations:
C:KaZaAMy Shared Folder or C:Program FilesKaZaAMy Shared Folder as
these files: MSN Crack.exe, MSN Hack.exe, ICQ Password, HotMail,
SpiderMan-PC-Game-v2 FullDownloader.exe, ICQ Hack.exe and Windows
(All Versions) KeyGen.exe 
 Also contains a payload which drops the W32.Badtrans.B@mm worm. It
does this by creating one of the following text files: WinSCR.txt,
WinDLL.txt, WinEXE.txt, WinCOM.txt or WinSYS.txt 
 It then uses that to create the file C:Aut0exec.bat, which creates
the virus executable as one of these files: WinSCR.scr, WinDLL.scr,
WinEXE.scr, WinCOM.scr or WinSYS.scr 
 Before the worm runs C:Aut0exec.bat, it displays this message: 
 Title:  W32.Join.A@mm says... 
 Message: Prepare for action..! 
 as well as several other messages

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.Run a full system scan and delete all files that are detected as W32.Wonna@mm.