VBS.Krim - amore.bat (F)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: VBS.Krim

Sender:

Varies.

Subject:

La tua amica Valentina (E)
Mi ami ancora ??? (F)
MIRKO
SMS for YOU by Valentina (B)
Sto male senza di TE (F)
Symantec center (D)

Message:

Apri il tuo cuore ! Valentina ti sta aspettando a Lecce (B)
Che stai facendo ????
Ciao... e da tanto che non ci sentiamo!!! Come stai ?? (E)
Mi perdoni per quello che ti ho fatto ?? Valentina (F)
Ti prego dammi una risposta t.v.b. la tua Valentina (F)
W32.Zokrim@mm VBS.Krim@mm VBS.krim.B VBS.krim.C delete !!! (D)

Attachment:

amore.bat (F)
C:WindowsValeMirko.bat (B)
Mirko.bat
mms.bat (E)
Vale.bat (D)

Comments: A worm that uses Microsoft Outlook MAPI to mail itself to all contacts in the Outlook address book.

Symptoms:


 Creates the folder C:WindowsMk and 4 files: C:WindowsMirko.vbs,
C:WindowsMirko.reg, C:WindowsMkMirko.vbs and
C:WindowsDesktopMirko.txt. The worm then copies itself as
C:WindowsMkMirko.bat. Next, it appends the following line to the end
of the C:Autoexec.bat file: @call C:windowssystemmirko.bat 
 Appends the text Rem Valentina I Love You to all .bat files (C) 
 Variant C may execute one of the following payloads: On October 10
of every year, the worm picks a random number from 1 to 1000. If the
random number is 1, it overwrites C:Autoexec.bat with commands to
format drive C and then restarts the system. This will reformat drive
C on Windows 95/98/Me-based computers. (C) 
 The worm picks a random number from 1 to 500. If the number is 7,
the worm deletes all .doc files from the infected system. (C) 
 On February 14 of any year, the worm enters a loop that continuously
displays this message: ***VALENTINA I LOVE YOU*** (C) 
 Renames the Windows file, %Windir%CommandFormat.com, to
%Windir%CommandChdisk.com. (F)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Dowload the most current virus defs.
Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files.
Run a full system scan.
Delete all files that are detected as VBS.Krim@mm.
Using Windows Explorer, delete C:\Windows\Mk\Mirko.vbs, C:\Windows\Mirko.reg,and C:\Windows\Desktop\Mirko.txt.
Edit the registry and delete the following value:mirko c:\windows\mk\mirko.bat
Edit the autoexec.bat file and remove the line that was added to the end of it.
Rename the format command (F)
Restore the Script.ini if you use mIRC (F)