W32.HLLW.Redist - WarpScreen.scr (gen)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Redist

Sender:

Varies.

Subject:

Better than KaZaA? (B)
Better than WinZip? (gen)
Fire ScreenSaver (gen,C)
Funny picture (C)
Joke book (B)
Modem booster (gen)
Program (gen)
Re: (B)
Read this before? (B)
Stupid picture (C)
The file (BC)
The passwords (C)
Warp ScreenSaver (gen)
Web design

Message:

Hello,Check out the joke book in the attachments! it has some really
good jokes(not lame jokes hehe)Have fun! (B)
Hello,Check out this ScreenSaver of fire!I think that it is one of
the best ScreenSavers that I have ever seen!Cya! (gen)
Hello,Have I sent you the Gift Card in the attachments before? if
not, check itout!Cya! (B)
Hello,have you read the "Hackers of 2002"?If you haven't, It is in
the attachments :)It contains true stories, hacking techniques, and
more!It is a fairly big thing to read, so don't read it all at
once!Cya! (B)
Hello,I have a fairly slow modem, that is, until I installed the file
in the attachments!This program is a "Modem booster", it can make your
internet connection go at most 2x faster :)Enjoy! (gen)
Here is a copy of that program that everyone is asking for.Please
don't delete it, because I might not send it to anyone else.Thanks.
(gen)
Here is that file you wanted (in the attachments). (B)
Here is that program that you asked for yesterday. (gen)
Here is the file that you asked for a few days ago.I'm sorry I sent
it this late (B)
If you download music files from the internet, you would know that
KaZaA isseen to be the best file-sharing network for music. Well, I
have included afile in the attachments that connects and downloads
music twic as fast aswhat KaZaA can do. It works well with my
computer!Enjoy! (B)
Try this file compressor that I downloaded from the net yesterday!I
have compressed some files, and it makes them at least 3 times
smaller!The installation file should be in the attachments as
"FileCompress.exe"Cya! (gen)
Try this warp ScreenSaver in the attachments!Cya! (gen)

Attachment:

Armadillo.pif (C)
Card_0(random.number).pif (B)
CartoonComedy.pif (C)
Database(a random number).pif (C)
FileCompress.exe (gen)
FireScreen.scr (gen,C)
Hackers(XXXX).pif (B)
JokeBook.pif (B)
ModemBooster.exe (gen)
Msprg32.pif (gen)
New Bitmap Image.pif(B)
New Microsoft Excel Worksheet.pif (B)
New Microsoft PowerPoint Presentation.pif (B)
New Microsoft Word Document.pif (B)
New Text Document.pif (B)
New WinZip File.pif (B)
P2PInstall.exe (B)
PswdLst01.pif (C)
Soccer(a random number).pif (C)
WarpScreen.scr (gen)
WebDesignSetup.exe (C)
Winprg32.pif (gen)
(random.filename).exe or (random.filename).pif (B)

Comments: A mass-mailing worm that attempts to email itself to all the contacts in the WindowsAddress Book. The worm also attempts to spread itself through the KaZaA file-sharing network.Attempts to steal information from an infected computer and send it to a specified emailaddress. The worm will attempt to terminate the processes of various programs, includingantivirus and firewall programs.

Symptoms:


 Adds the value: "Outsider"="W32/Outsider by Zed" to the registry
key: HKEY_CURRENT_USERSoftwareZedOutsider (gen) 
 Displays a fake message, titled "Error Starting Program." (C)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: End the Trojan process.
Run a full system scan and delete all the files detected as W32.HLLW.Redist@mm.
Reverse the changes that the Trojan made to the registry.
Delete the files:
%Windir%\Inetdun32.txt
%Windir%\Inetcon32.txt