W32.HLLW.Symten - MS_UPDATE

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Symten

Sender:

Varies.

Subject:

Composed of 4 words, one from each of the following lists:
Re:, Fwd :, RE: RE:,
New, This is cool, Watch out, Open , Look at,
MSPatch, Program, Patch, update
(237), (2378), (23781), (237813)

Message:

Look at this!!! Microsoft svchost Patch:Please run a search on your
computer for the file name SVCHOST.EXE if this file is foundon your
system run the update patch provided in the attatchment of this
email.Regards,Adam VoldranMSUpdate DevisionMicrosoft Corp.

Attachment:

5283952.exe
6BDD1FC1-810F-11D0-BEC7-08002BE2092F.EXE
CHANNEL_UKVX(undernet).exe
elkern_UPS_23913.exe
HI_KIRSTY.exe
I_AM_A_WORM_DONT_OPEN_ME_LOL.exe
INFECT_YOUR_COMPUTER_NOW(hehe).exe
ITS_A_BOMB.exe
massive_head_injury.jpg.exe
MS_UPDATE_(126).exe
oleaut32.exe
QuickTimeUpdateHelper.exe
svchost.exe
swflash.exe
SYMTEM_(Writen_by_INDUSTRY).exe
up(21379123).exe
WINDOWS_XP.exe
x86_Microsoft_Windows_CPlusPlusRuntime_6595b64144ccf1df_x-ww_2726e76a.exe
x86_Microsoft_Windows_Networking_Dxmrtp_6595b64144ccf1df_4868_x-ww_212f7d9e.exe
x86_Microsoft_Windows_Networking_RtcDll_6595b64144ccf1df_4868_x-ww_b168a28c.exe

Comments: A mass-mailing Worm that distributes itself by randomly generated email.

Symptoms:


 It drops itself into the following directories: c:, c:winnt,
c:windows using the following filenames:
6BDD1FC1-810F-11D0-BEC7-08002BE2092F.EXE.
x86_Microsoft_Windows_Networking_Dxmrtp_6595b64144ccf1df_4868_x-ww_212f7d9e.exe,
x86_Microsoft_Windows_Networking_RtcDll_6595b64144ccf1df_4868_x-ww_b168a28c.exe,
x86_Microsoft_Windows_CPlusPlusRuntime_6595b64144ccf1df_x-ww_2726e76a.exe,
svchost.exe, oleaut32.exe, swflash.exe among others. 
 Adds the value Swf32 C:_backup.exe to the registry key
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan, and delete all files that are detected as W32.HLLW.Symten@mm.
Delete the value that the worm added to the registry, and restore the values thatthe worm changed.
Restore deleted or overwritten files