W32.Kergez - Virusun_Ensesine

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Kergez

Sender:

Varies.

Subject:

Are you vulnerable to identity theft!
Cleans and removes infected files
InternetExplorer security patch
Kisacasi AntiVirusleri update etmeyi unutmayin ;)
Microsoft Software Update Services
Now its even easier to reduce spam
Online hackers
Position Virus Percentage by Occurrence...
Protects against Trojans hackers
Protects against viruses
Protects against viruses, worms, Trojans & hackers.
Saves money with 12 months of fast free antivirus updates
The easy, automatic way to keep your PC virus free

Message:

WARNING!Are you vulnerable to identity theft!
WARNING! Be safe, be smart! Never surf the Net without a Personal
Firewall Plus barrier between your hard drive and hostile cyber
traffic.
WARNING! Especially over high-speed broadband connections, Internet
hackers and identity thieves feast on unguarded PC connections (maybe
yours) to steal passwords, credit card numbers and personal ID. Even
turn your machine into a zombie to attack others.
WARNING! Get the ultimate in protection with our newly updated Junk
Mail Filter!
WARNING! Kaspersky Labs announces the regularly scheduled release of
the Kaspersky Anti-Virus cumulative database update.
WARNING!Microsoft Software Update Services is designed to greatly
simplify the process of keeping Windows-based systems up-to-date with
the latest critical updates.SUS enables administrators to quickly and
reliably deploy critical updates to their Windows 2000-based servers
and Windows 2003-based servers as well as desktop computers running
Windows 2000 Professional or Windows XP Professional.
WARNING! Online hackers know more than 2500 ways to break into naked
unprotected PC systems.In seconds they steal private files credit
card statements tax records passwords even Social Security Numbers
WARNING! Norton Antivirus: Object scanning optimization for improved
performance Additional functionality for checking files compressed...
WARNING! Sophos: The update includes an array of new functions and
improvements: ...
WARNING! The percentage shown represents the percentage of registered
incidences. Position Virus Percentage by Occurrence...

Attachment:

Antivir.exe
BullGuard_Patch.exe
DDoS_Kill.exe
DoS_Protect.exe
Flood_Protect.exe
Fprot_Patch.exe
Internet_Speed.exe
InternetWorm_Clean.exe
Kaspersky_Patch.exe
Norton_Patch.exe
PantaAntivirus_Patch.exe
Protect.exe
Security.exe
Sophos_Patch.exe
TrendMicro_Patch.exe
Virus_Block.exe
Virus_Cleaner.exe
Virus_Guard.exe
Virus_Hunter_II
Virus_Research.exe
Virusun_Ensesine_Tokat.exe
WinXP_Virus_Patch.exe

Comments: A mass-mailing worm that sends itself to all the email addresses that it finds in thefollowing files:Files with the *.asp, *.ht* extensions.Files located in any of the directories specified in the registry keyHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Symptoms:


 Copies itself to the %Windir% folder as Systray_.Exe where %Windir%
is the installation folder. 
 Adds the value: "Systray"="%windir%Systray_.Exe" to the registry
key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun 
 Adds the value: "Cekirge"= (path to worm) to the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices 
 Attempts to terminate antivirus programs.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Kergez.A@mm.
Edit the Win.ini file (Windows 9x/Me).
Reverse the changes made to the Registry.