W32.HLLW.Backzat - WuFFie.Scr (B)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Backzat

Sender:

Varies.

Subject:

Duuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuude (B)
Fw: Hello there. (G)
Heyhey! (C)

Message:

Hey, I just recieved a screen saver in the mail and it is really cute.
Take a loot. (G)
Whoa man amuse yourself with this funny freakin screen saver (B)
Ya know man, I've seen funny things in my life but this screen saver
beats them all, You have to check this out. (C)

Attachment:

BBbLWDB.Scr (C)
CuteKirby.Scr (G)
WuFFie.Scr (B)

Comments: A mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Microsoft Outlook Address Book. It also attempts to spread itself through the eDonkey2000, BearShare, Morpheus, and KaZaA file-sharing networks. This worm may distribute itself through the mapped drives AIM95, mIRC, and ICQ. It also deletes security software from your computer when it is executed.

Symptoms:


 Copies itself as: C:%Windir%WuFFie.Scr and C:%System%WuFFie.Scr (B) 
 Adds the value: BatzBack C:%Windir%WuFFie.scr to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun so that
the worm runs when you start Windows. (B) 
 Adds the value BatzBack C:%System%WuFFie.scr: to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices so
that the worm runs when you start Windows. (B) 
 Displays a fake message that says _There was a critical error in the
application the video drivers could not load._

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Backzat.B.
Reverse the changes made to the registry.