W32.Coronex - Virus.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Coronex

Sender:

corona@hotmail.com
deaths@china.com
sars@hotmail.com
virus@china.com
Virus2@china.com
virus@yahoo.com

Subject:

bye
Corona Virus
I need your help
SARS
SARS Virus
Virus Alert!

Message:

deaths virus
honk kong
SARS Corona Virus
SARS Virus
SEE Ya
Severe Acute Respiratory Syndrome

Attachment:

Corona.exe
Cv.exe
Deaths.exe
Hongkong.exe
Sars.exe
Sars2.exe
Virus.exe

Comments: A mass-mailing worm that uses its own SMTP engine to send itself to all the contacts in the Windows Address Book.

Symptoms:


 Displays a message window entitled SARS Virus with the message
corona virus 
 Adds the value: "PC-Config32"="-A" or:
"PC-Config32"="%Windir%corona.exe" in the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 Changes the start page of Internet Explorer to:
www.who.int/csr/don/2003_04_19/en by modifying a value in the registry
key: HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain 
 Creates a file in the C:My Downloads folder, using one of these
filenames (among others): Age Of Mythology.exe, Battlefield 1942
(full).exe, (Black Hawk Down (full).exe, Cossacks Full Version.exe,
Dark Age of Camelot.exe, Doom 3.exe, Jedi Knight II.exe, Oni full.exe,
Quake 3 Full Version.exe, Rainbow 6 Full.exe, Return to Castle
Wolfenstien (Full).exe, Starcraft full.exe, The Sims: Unleashed.exe,
Tribes 2 (full).exe, V|'Command & Conquer: Generals.exe, Warcraft III
Full.exe and White and Black.exe

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Restart the computer in Safe mode.
Run a full system scan and delete all the files detected as W32.Coronex@mm. Manually delete the files that the worm placed into the C:\My Downloads folder.
Delete the value that was added to the registry.
Reset the Internet Explorer home page.