W32.Hiton - aboutyou.pif

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Hiton

Sender:

Spoofed.

Subject:


Another one?
Attatchments
Ciao
Ciao TONA
Congratulations TONA!
Darling
Do not release, its the internal rls!
elegant ppl should satisfy thier taste with elegant things ;)
Error
fake
gift for you TONA :)
Happy Times :)
hello
hello TONA
Here|s a nice Picture
here|s the archive you requested
here|s the document
here|s the document you requested
Hey I thought you trusted me but ...
Hey Wussap?
hey wuts up TONA?
hey wuts up?
heyyy
heyyy TONA
Heyyyyyyyy Lola Wussaaap??
hi TONA
Hiiiiiii
Hiiiiiii TONA
hola
hola TONA
information
information for you, TONA
La Transaction De Courrier A TchouT
La Transazione Della Posta + venuto a mancare
leaked
Mail Delivery System
Mail Transaction Failed
New Internal Rls...
Pr0n!
read it immediately
Returned mail --
Server Report
something for you
Status
stolen
TONA, you have to see this!
Undeliverable mail --
unknown
Useful
Very funny
Wait for more :)
warning

Message:

about me
anything ok?
do you?
from the chatter
greetings
Have a look at the attatchment.
Have a look the Pic attached !!
here
here is the document.
Here is the FRNA ;) Dont tell Sam abt itONCRCya
here it is
here, the cheats
here, the introduction
here, the serials
Here|s the document that you had requested.
HEY TONA, call FRNA a virus text stealer =)
heyyyy i tried many times to send u this email but ur account was out
of storage as i thinkONCRany way , make sure that i didn't and i won't
forget u :)ONCRCya Forgotten :P
Heyyyy TONAI lost the other email , anyway i sent u all u needONCRi
have just got it , plz tell me if u need more.bye
Hi TONA its FRNA.ONCRONCRI was shocked, when I found out that it
wasn't you but your twin brother,ONCRthat's amazing, you're as like
as two peas. No one in bed is better thanONCRyou TONA. I remember, I
remember everything very well, that promised youONCRto tell how it
was, I'll give you a call today after 9. He took my skirtONCRoff,
then my panties, then my bra, he sucked my t**s, with the same
furyONCRyou do it. He was writing alphabet on my pussy for 20
minutes, thenONCRsuddenly stopped, put me in doggy style position and
stuck his dagger.ONCRBut TONA, why didn't you warn me that his dick is
15 inches long? I wasONCRstruck, we fucked whole night. I'm so
thankful to you, for acquainted meONCRto your brother. I think we can
do it on the next Saturday all threeONCRtogether? What do you think? O
yes, as you wanted I've made a few picturesONCRcheck them out in
archive, I hope they will excite you, and you will dreamONCRof our
new meeting...ONCRONCRGreetz FRNA
Hummm , i hope u accept this show as an apology.ONCRsave it for hard
times
I can't be online tonight :(anyway , i sent u something u r gonna
love ;)ONCRcya tomorrow
I forgot to tell u , the other file is with FRNA:) bye
i found this amazing file in my Recycled , i know u love this kind of
things ;)ONCRcyaaa
i found this document about you
I have a document attached,ONCRwhich should solve your problems.
I have your password!
i haven't ever thought i should send u my briefcase to gain ur
Trust.ONCRHave it all :) bye
i hope it is not true!
i just wanted to say sorry for last nightONCRand .. i wish u accept
this as an apologyONCRbye dear
i lost FRNA's Email plzz send this file to her :)ONCRand tell her i
can't be online tonightONCRBye
i thing the subject is enough to describe the attached file
!ONCRcheck it out and replay your opinion
i wait for a reply!
i will be waiting for u emaill to remind me of your self.
i'm fine , thanx for asking :) ONCRand thanx for the nice
attachements.ONCRbut unfortunately, i don't remember you
i'm waiting
information about you
is that from you?
is that true?
is that your account?
is that your name?
i've got this surprise from a friend :)ONCRit really deserves a few
minutes of your time.ONCRNever mind !
I've got your email , but you forgot to upload the
attachments.ONCRDon't be selfish , i sent you all the files i have,
send me anything :(
kill the writer of this document!
Mail transaction failed. Partial message is available.
misc
my hero
ok
read it immediately!
read the details.
Real outtakes from Sex in the City!!ONCRAdult content!!! Use with
parental advisory =)
reply
See the attached file for details.
see you
Send me your comments.
sendmail daemon reported: Error #804 occured during SMTP
session.ONCRPartial message has been received.
something about you!
something is fool
something is going wrong
something is going wrong!
stuff about you?
take it easy
that is bad
That|s the answer to all your questions.
that's funny
thats wrong
The Archive is attached...
The message cannot be represented in 7-bit ASCII encodingONCRand has
been sent as a binary attachment.
The message contains MIME-encoded graphicsONCRand has been sent as a
binary attachment.
The message contains Unicode charactersONCRand has been sent as a
binary attachment.
what does it mean?
why?
yes, really?
YO TONA , IM SICK OF UR EMAILS , IF U LOSE IT AGAIN I WONT GIVE IT TO
U, SAVE ITONCRBYEEE
you are a bad writer
you are bad
you earn money
you feel the same
you seem to be mad @ me coz i didn't send u anything for along
time,ONCRi didn't forget u , but i was kinda busy , i've got all of
ur emailsONCRthanx :) and i hope u accept this one as an apology.
you try to steal
your name is wrong

Attachment:

aboutyou.bat
aboutyou.exe
aboutyou.pif
aboutyou.scr
attachment.bat
attachment.exe
attachment.pif
attachment.scr
bill.bat
bill.exe
bill.pif
bill.scr
body.bat
body.exe
body.pif
body.scr
concert.bat
concert.exe
concert.pif
concert.scr
creditcard.bat
creditcard.exe
creditcard.pif
creditcard.scr
details.bat
details.exe
details.pif
details.scr
dinner.bat
dinner.exe
dinner.pif
dinner.scr
disco.bat
disco.exe
disco.pif
disco.scr
doc.bat
doc.exe
doc.pif
doc.scr
documen.batt
documen.exet
documen.pift
documen.scrt
final.bat
final.exe
final.pif
final.scr
found.bat
found.exe
found.pif
found.scr
friend.bat
friend.exe
friend.pif
friend.scr
information.bat
information.exe
information.pif
information.scr
jokes.bat
jokes.exe
jokes.pif
jokes.scr
location.bat
location.exe
location.pif
location.scr
mail.bat
mail.exe
mail.pif
mail.scr
mail2.bat
mail2.exe
mail2.pif
mail2.scr
mails.bat
mails.exe
mails.pif
mails.scr
me.bat
me.exe
me.pif
me.scr
message.bat
message.exe
message.pif
message.scr
misc.bat
misc.exe
misc.pif
misc.scr
msg.bat
msg.exe
msg.pif
msg.scr
nomoney.bat
nomoney.exe
nomoney.pif
nomoney.scr
note.bat
note.exe
note.pif
note.scr
object.bat
object.exe
object.pif
object.scr
part2.bat
part2.exe
part2.pif
part2.scr
party.bat
party.exe
party.pif
party.scr
posting.bat
posting.exe
posting.pif
posting.scr
product.bat
product.exe
product.pif
product.scr
ps.bat
ps.exe
ps.pif
ps.scr
ranking.bat
ranking.exe
ranking.pif
ranking.scr
release.bat
release.exe
release.pif
release.scr
shower.bat
shower.exe
shower.pif
shower.scr
story.bat
story.exe
story.pif
story.scr
stuff.bat
stuff.exe
stuff.pif
stuff.scr
swimmingpool.bat
swimmingpool.exe
swimmingpool.pif
swimmingpool.scr
talk.bat
talk.exe
talk.pif
talk.scr
textfile.bat
textfile.exe
textfile.pif
textfile.scr
topseller.bat
topseller.exe
topseller.pif
topseller.scr
website.bat
website.exe
website.pif
website.scr

Comments: A mass-mailing worm that uses its own SMTP engine to send itself to email addresses thatit finds on an infected computer

Symptoms:


 Copies itself as %Windir%Svchost.exe 
 Adds the value: "Service Host Driver"="%Windir%svchost.exe" to the
registry key:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun so that
the worm runs when you start Windows. 
 Adds the value: "(Default)" = "%System%mssvc.dll" to the registry
key:
HKEY_CLASSES_ROOTCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED}InProcServer32
so that Explorer.exe loads Mssvc.dll. 
 Adds the value: "AutoRun"= "%Windir%svchost.exe" to the registry
key: HKEY_CURRENT_USERSoftwareMicrosoftCommand Processor

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Hiton@mm.
Delete the value that was added to the registry.