W32.Gibe - Varies (C)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Gibe

Sender:

Microsoft Corporation Security Center (gen)
Varies (C)

Subject:

Internet Security Update (gen)
The subject is composed by adding one value from each of the
following lists:
List One
(Blank)
FW:
FWD:
RE:
List Two
Check
Check out
Look at
Prove
See
Take a look at
Taste
Try
Watch
List Three
(Blank)
that
the
these
this
List Four
(Blank)
correction
security
List Five
pack
patch
update
List Six
(Blank)
which
List Seven
came
comes
List Eight
(Blank)
the
List Nine
M$ Corporation
Microsoft
For example, the subject line might say:FWD: Watch this security
update which comes from Microsoft. (B)
Varies (C)

Message:

Microsoft Clientthis is the latest version of security update, the,
Cumulative Patch update whicheliminates all known security
vulnerabilities affecting Internet Explorer,Outlook and Outlook
Express as well as five newly discoveredvulnerabilities. (B)
Microsoft Customer, this is the latest version of security update,
the update whicheliminates all known security vulnerabilities
affecting Internet Explorer andMS Outlook/Express as well as six new
vulnerabilities. (gen)
NA (C)

Attachment:

Q216309.exe (gen)
Random with .exe or .zip file extension (B)
Varies (C)

Comments: This is an email worm that uses Microsoft Outlook and its own SMTP engine to spread.It disguises itself as a Microsoft Internet Security Update.

Symptoms:


 Creates the key: HKEY_LOCAL_MACHINESoftwareAVTechSettings and adds
the following values to that key: 
 Installed ... by Begbie 
 Default Address (Default Email Address) 
 Default Server (Default Server)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update your virus definitions.
Restart the computer in Safe mode.
Run a full system scan and delete files that are detected as W32.Gibe@mm, and then delete the 02_N803.dat file.