W32.Cissi - Zipped

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Cissi

Sender:

Varies.

Subject:

Heres a poem for you
How could u do that
How do you feel inside
I do love you
I do miss you
I love you until im dead,
I never want to go.
I stand here inside
I stand here undone
I wish i just could hide
It will all be fine.
Ive written a poem for you
Love poems for you :)
Look what i wrote for you
Poems for you
Roses are red,
what you want me to do?
Where did you run?
Where did you hide?
Why did you say that
You are mine,

Message:

NA

Attachment:

LovePoem.pif
My Poems.txt.exe
My Story.pif
Only Poems.txt.pif
Poem_collection.pif
Poems.pif
Poems for you.pif
Sad Stories and Poems.pif
The Poems.pif
Zipped_poems.exe

Comments: A mass-mailing worm, which also contains backdoor functionality to connect to an IRC server.Can spread over the network using the NetBIOS protocol. It can spread to systems that do nothave passwords or to ones that have simple passwords. Can also wait for commands.

Symptoms:


 Makes copies of itself as %System%Cissi.exe. 
 If the operating system is Windows 95/98/Me, the worm modifies the
System.ini so that the worm is executed each time you restart the
computer. If the operating system is Windows NT/2000/XP/2003, the
worm will contain code to modify the Windows registry so that it will
run when you start Windows.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Cissi.A@mm.
Delete the value that was added to the System.ini (Windows 95/98/Me).