W32.Zorro - Zorro.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Zorro

Sender:

Varies.

Subject:

Buena PECHOnalidad
Con todo mi aprecio
Diviertanse
Echale un ojo a esto
El aguijon de Scorpion
Este si que es un buen presente
Mujeres
Sorpresa !!!
Todo debe estar limpio
Traseros

Message:

Abrelo no hay PELIGRO, esta limpio de Virus
Dime si te gusto
Espero que esto te guste
Esto si esta interesante abrelo que no hay peligro
Mira que bueno esta esto
No tiene ningun Virus
No tiene Virus, asi que abranlo y disfrutenlo
Observa el gran poder de las mujeres en su parte trasera
Scorpion hace de las suyas

Attachment:

Bigs as.exe
Canibal.exe
Corte de pelo.exe
Honey.exe
Jefes.exe
Josefina.exe
Picadita.exe
Play.exe
Tangas.exe
Zorro.exe

Comments: A mass-mailing worm that will send itself to all the addresses in the Windows Address Book.

Symptoms:


 Copies itself as one of the following files: %System%Bigs as.exe,
%System%Canibal.exe, %System%Corte de pelo.exe, %System%Honey.exe,
%System%Jefes.exe, %System%Josefina.exe, %System%Picadita.exe,
%System%Play.exe, %System%Tangas.exe and %System%Zorro.exe 
 Attempts to delete all the files with .inf and .sys file extensions.

 Adds the value: "Scorpion"="%System%" to the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Zorro@mm.
Delete the value that was added to the registry.