W32.Chir - PP.exe (B)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Chir

Sender:

(username)@hotmail.com or iloveyou@btamail.net.cn
(username)@yahoo.com or imissyou@btamail.net.cn (B)

Subject:

Hi, i am (username)
(username) is coming (B)

Message:

NA

Attachment:

P.exe
PP.exe (B)

Comments: A mass-mailing worm that uses its own SMTP engine to send itself to all contacts itfinds finds in the Windows address book.

Symptoms:


 Adds the STRING value: Runonce C:WindowsSystemRunouce.exe to the
registry key
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions, restart in Safe mode, and run a full system scan.
Delete all files that are detected as W32.Chir@mm.
Delete the valuethat was added to the registry keyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Update virus definitions.
Shut down the computer, and turn off the power. Then restart the computer in Safe mode and runthe scan again.
Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files.
Run a full system scan.
Delete all files that are detected as W32.Chir@mm.