W32.Yalat - WarCraft III No-CD(all versions)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Yalat

Sender:

NA

Subject:

Failure notice!
Funny thing :)!

Message:

Hi again!ust found this funny game in the web. I've got 2473 points,
do you beat my highscore? ;) Ok, cya later!
I'm sorry, but It wasn't possible for me to deliver your message to
the recipient you requestet. Open the attachment to see your original
mail.

Attachment:

FixKlez.exe
Half-Life No-CDCrack.exe
Madonna Screensaver.exe
Setup.exe
StarCraft BW 1.09bNo-CD Crack.exe
WarCraft III No-CD(all versions)
Windows 2000Serial.exe
WindowsXP Crack.exe
WinzipSerial.exe
Your Original Mail.eml(several spaces).exe

Comments: A worm that attempts to spread by using MAPI and by copying itself to shared folders. It alsoattempts to stop the processes of some antivirus programs

Symptoms:


 Copies itself as %Windir%WinHaelp.exe where %Windir% is the
installation folder. 
 Modifies the load= line in the Win.ini file to: 
 load=WinHaelp.exe 
 Modifies the shell= line of the System.ini file to: 
 shell=Explorer.exe WinHaelp.exe 
 Adds the value: WinHaelp.exe %Windows%WinHaelp.exe to the registry
key: 
 HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Run a full system scan, and delete all files that are detected as W32.Yalat.Worm.
Delete the value:WinHaelp.exe %Windows%\WinHaelp.exefrom the registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Reverse the changes that the worm made to the Win.ini and System.ini files.