W32.Recory - Killvir.com

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Recory

Sender:

Varies.

Subject:

Will be one of the following and may have the prefix Fwd: or Fw:
Attention company personal
Attention Employees
Attention users
Client support
Computer issue
Computer virus alert
Computer virus fix tool
Computer virus information
Computer virus outbreak
Computer virus removal
Computer virus removal tool
Damaged Software information
Email security update
Email support
Email virus alert
Free support
From helpdesk support
High-risk computer virus removal
High-threat computer virus fix
Important
Important information
Latest News
Latest news
Latest computer virus outbreak
Microsoft news
Microsoft support
Read this
Security update
Serious alert
Severs virus alert
Software alert
Software patch
Software support
Technical support
Urgent
Urgent information
Urgent news

Message:

Hello readers,I have just cleaned my computer from a highly damaging
computer virusWhich is spreading rapidly through computer networks
worldwide.There is one way to check to see if your computer is
infected with thisvirus.Click the "Start" menu at the bottom left of
your screen.Click the "Find" or "Search" button.Click the "Files or
folders..." option.Then once the search application starts, type
"Jdbgmgr.exe"If you have found this file, right-click on it and click
the "Properties"tab.If the Properties menu has a picture of a bear on
it,your computer is infected with this virus. (Note that the
non-infected filepicture has a hammer and a screwdriver shown in
it)You may delete this file, but this is not the only file that the
virusinfects,To remove this virus, I have included a virus removal
tool in theattachments ""that will scan all system files and remove
any infectious code from them.This virus removal tool is very easy to
use. If you have any trouble withthis tool,read the help menu that the
removal tool supplies.If your computer is infected with this virus, It
is strongly recommendedthat you send this removal tool to as many
peopleas you can to help remove the traces of this virus worldwide.

Attachment:

Cleaner.com
Cleaner.exe
Cleaner.pif
Cleanvir.com
Cleanvir.exe
Cleanvir.pif
Cleanvirus.com
Cleanvirus.exe
Cleanvirus.pif
Fixtool.com
Fixtool.exe
Fixtool.pif
Fixvir.com
Fixvir.exe
Fixvir.pif
Killvir.com
Killvir.exe
Killvir.pif
Killvirus.com
Killvirus.exe
Killvirus.pif
Removal.com
Removal.exe
Removal.pif
Removal32.com
Removal32.exe
Removal32.pif
Scan32.com
Scan32.exe
Scan32.pif
Scanvir.com
Scanvir.exe
Scanvir.pif

Comments: A mass-mailing worm that uses Microsoft Outlook to email itself to all the contacts inthe Windows Address Book. It also attempts to spread across a file-sharing network.

Symptoms:


 When run, copies itself as the following files: 
 %windir%Autotest.com 
 %windir%Startwin.com 
 %windir%TaskBoot.com 
 %windir%Winboot32.com 
 %windir%Jdbgmgr.exe 
 %windir%Compile32.pif 
 %windir%Security.pif 
 %windir%Uninstall32.pif 
 %windir%Windows Startup.pif 
 %windir%COMMANDEBDWinexec.bat 
 %windir%Start MenuProgramsStartupSysTray.pif 
 %system%Autoexec32.bat 
 %system%Jdbgmgr.exe 
 %system%Memory.com 
 %system%RecoveryWorm32.scr 
 %tempdir%Jdbgmgr.exe 
 FixTool.exe 
 (where %windir% in the default windows folder, usually c:windows) 
 Adds the value Msdos32      %system%Msdos32.pif to the registry key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun so that
the worm runs whenever Windows is started. 
 Displays a message saying: It seems to me that your computer is in
need of an urgent recovery!.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Delete the value Msdos32 from the registry key it was entered in (see above)
Restart the computer.
Update the virus definitions,
Run a full system scan and delete all the files detected as W32.Recory@mm.