W32.Appix - PamAnderson.scr (BCD)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Appix

Sender:

Varies.

Subject:

Application Booster (D)
test23
Is a combination of:
A nice Screensaver of (BCD)
Ein netter Screensaver von (BCD)
Eine neue Version von (BCD)
Important!: (CD)
New Version of (BCD)
Wichtig!: (CD)
and
Angelina Jolie (BCD)
Anna Kournikova (BCD)
BestTool (BCD)
Brute Force Tool (BCD)
Flashget (BCD)
Kündigung (Provider) (CD)
Pamela Anderson (BCD)
Porn Screensaver (BCD)
Sex ScreenSaver (BCD)
TvTool (BCD)
Undelivarable Email (BCD)
WarezBoardAccess (BCD)

Message:

Try the Free Application Boost Pack, NOW !!!! (D)

Attachment:

AnnaKournikova.scr (BCD)
Appboost.reg (D)
Appboost.vbs (D)
BestTool.exe (CD)
FlashGet.exe (BCD)
FreeSex.exe (BCD)
Jolie.scr (BCD)
PamAnderson.scr (BCD)
Test.scr
TvTool.exe (BCD)
Undelivarablemail.exe (BCD)
Vertrag.exe (CD)
WarezBoardAccess.exe (BCD)
XXX.scr (BCD)

Comments: A worm that attempts to spread across file-sharing networks such as KaZaA and eDonkey2000;Also contains it own SMTP client engine that permits it to replicate using email.

Symptoms:


 It drops itself using the file names %windir%Appboost.exe and
%windir%Appbsvc.exe where %windir% is the Windows main installation
folder (by default this is C:Windows or C:Winnt). 
 Updates the (Default) value of the key
HKEY_LOCAL_MACHINESOFTWAREClassesexefileshellopencommand with the
contents %windir%appboost.exe "%1" %*

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Do one of the following:
If Windows 95/98/Me: Restart the computer in Safe mode.
If Windows NT/2000/XP: Stop the worm process.
Reverse the changes that the worm made to the registry.
Do one of the following:
If Windows 95/98/Me: Restart the computer in normal mode.
If Windows NT/2000/XP: Restart your Symantec antivirus product.
Update the virus definitions.
Run a full system scan, and delete all files that are detected as W32.Appix.Wormor PHP.Appix.