W32.Updater - Letter.Doc.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Updater

Sender:

Varies.

Subject:

The subject is assembled from the following strings(an example would
be "Have you Check out this Transaction")
Account
Bank Account
Check
Check out
Documment
For this
Fwd :
Have you
How to
Just
Look at
Nude pic
Open
Osama Vs Bush
Patch
Picture
Private Pic
Program
Quotation
Re:
Report
The
this
Transaction
Watch out
Why Not you
WTC Tragedy
You Should

Message:

Hi:This is the file you ask for, Please save it to disk and open this
file,it's very important.

Attachment:

Files.exe
install.exe
Letter.Doc.exe
Picture.exe
Picture.jpg.exe
Quotation.Doc.exe
Readme.exe
Setup.EXE

Comments: A simple mass-mailing worm that sends itself to all recipients in an affected user's Microsoft Outlook address book. It also creates a script that propagates itself to all local and network mapped drives.

Symptoms:


 Adds the value "Update   c:windowsupdate.exe" to the registry key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 Displays a message saying "Cannot Open files. It does not appear to
be a valid archive."

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: To remove the worm files:
Follow the instructions for your version of Windows:
Windows 95/98/NT/2000
Click Start, point to Find or Search, and click Files or Folders.
Make sure that "Look in" is set to (C:) and that Include subfolders is checked.
In the "Named" or "Search for..." box, type--or copy and paste--the following file names:
update.exe update.vbs
Click Find Now or Search Now.
Select Update.exe, press Delete, and click Yes if you receive a confirmation prompt.
Repeat step 5 for Update.vbs.
Windows XP
Click Start.
Click Search.
Click "All files and folders."
In the "All or part of the file name" box, type
update.exe update.vbs
Click Search.
Select the Symredir.dll file that is displayed, press Delete, and click Yes if you receive a confirmation prompt.
To edit the registry:
CAUTION: We strongly recommend that you back up the system registry before you make any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure that you modify only the keys that are specified. Please see the document How to back up the Windows registry before you proceed.
Click Start, and click Run. The Run dialog box appears.
Type regedit and then click OK. The Registry Editor opens.
Navigate to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the following value:
Update c:\windows\update.exe
Click Registry, and click Exit.
Restart the computer.