VBS.Hypoth - UpdateInstaller.vbs

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: VBS.Hypoth

Sender:

Varies.

Subject:

Check this out, (Recipient's Name)!
Hello (Recipient's Name)!
Here is that file you wanted, (Recipient's Name).
Hey (Recipient's Name)!
Urgent Update!

Message:

Have fun with these great jokes!(Sender's Name)
Hello (Recipient's Name), check out these pictures of my last
holiday! Don't get jealous!(Sender's Name)
(Recipient's Name)! Get free mp3s from the web site that i go to! I
can get almost any music that I want, just look at all the cool sites
that I went to in the attachments.Bye
(Recipient's Name),Your computer will need this update to protect
your computer from new email viruses. I installed this update and it
works fine.Thanks.
This is the file you wanted - don't let anyone else see it!(Sender's
Name)

Attachment:

Confidential.vbs
Holidaypics.vbs
Jokes.vbs
Readme.vbs
SecurityUpdate.vbs
Sitelist.vbs
Update.vbs
UpdateSecurity.vbs
UpdateInstaller.vbs
UpdateSetup.vbs

Comments: A mass-mailing worm that uses Microsoft Outlook to email itself. It infects .vbs and .vbefiles and renames audio and video files.

Symptoms:


 Copies itself to the WindowsSystem folder as one or more of the
following file names: 
 Confidential.vbs 
 Holidaypics.vbs 
 Jokes.vbs 
 (random characters).vbs 
 Readme.vbs 
 Runmnt32.vbs 
 Runmsdsk32.vbs 
 Securityupdate.vbs 
 Sitelist.vbs 
 Update.vbs 
 Updateinstaller.vbs 
 Updatesecurity.vbs 
 Updatesetup.vbs 
 Winnt32.vbs 
 It adds one of these values, with a value data that refers to one of
the files in the previous list: Runxpdsk32, Winnt32, Runmnt32 
 to the registry key 
 HKEY_LOCAL_MACHINEsoftwareMicrosoftWindowsCurrentVersionRun

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions
Run a full system scan.
Delete all files that are detected as VBS.Hypoth@mm.
Delete the value that it added to the registry keyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run