W32.HLLW.Cayam - eBayVerify.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Cayam

Sender:

Varies.

Subject:

Verify your eBay account information

Message:

Dear Ebay user,It has come to our attention that your eBay Billing
Information records are out of date.That requires you to update the
Billing Information  If you could please take 5-10 minutesout of your
online experience and update your billing records, you will not run
into anyfuture problems with eBay's online service.  However, failure
to update your records willresult in account termination.  Please
update your records in maximum 48 hours.  Once youhave updated your
account records, your eBay session will not be interrupted and will
continueas normal.  Failure to update will result in cancellation of
service. Terms of Service (TOS)violations or future billing
problems.Please open attachment to update your billing records.Thank
you for your time!Marry Kimmel,

Attachment:

eBayVerify.exe

Comments: A mass-mailing worm that uses Microsoft Outlook to send itself to all the contacts in the Outlook Address Book

Symptoms:


 Copies itself as C:WindowsMsfind32.exe and C:eBayVerify.exe 
 Adds the value: "MSFind32"="c:windowsmsfind32.exe" to the registry
keys: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce so
that the worm runs when you start Windows.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Cayam@mm.
Delete the value that was added to the registry.