W32.Ajm - WorldCup.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Ajm

Sender:

NA

Subject:

[Korean text]

Message:

Contains the text "....GO Go 2002 World Cup Corea!!"

Attachment:

2002.exe
Go Korea.exe
Heddink.exe
RedDevil.exe
WorldCup.exe

Comments: A mass-mailing worm that uses Microsoft Outlook to send itself to email addresses that itretrieves from all unread email messages.

Symptoms:


 It copies itself to the C:%system% folder. The file name is
randomly-chosen from a list carried by the worm. Some of the file
names contain Korean characters. Some examples of the file names are:
BihUpdate.exe, MsCrt32.exe, SysRtw32.exe, Temp32.exe, User32Rem.exe,
UserGDL.exe and Win32Dll.exe. 
 Adds a value that refers to this file in the registry key 
 HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun 
 This causes the worm to run when you restart Windows. 
 If the day of the week is Thursday, the worm displays a message. The
text is written in Korean. The title of the message is, "Message From
A" 
 If the month is June, it displays a message each time that it runs.
The text contains some Korean characters and "Here We Go! World Cup
Corea!" 
 If the month is December, it restores all maximized windows to their
previous size, and it opens a window. 
 If the month is November, It swaps the mouse button each time that
it runs. 
 If the date is July 7th, it keeps on setting the cursor to a
particular position. 
 If the date is January 1st, it confines the cursor to a rectangular
area on the screen.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions and run a full system scan.
Delete all of the files that are detected as W32.AJM.Worm.
Delete the value that the worm added to the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run