W32.Galil - iLLeGal.exe

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Galil

Sender:

Varies.
May spoof the sender. (F)

Subject:

(blank) (F)
amazing! (F)
Another one? (F)
Attatchments (F)
Check this out ;) (C)
elegant ppl should satisfy thier taste with elegant things ;)Wait for
more :) (F)
emazing!(C)
Enjoy! (C)
Fw: (C)
Fwd: Crazy illegal sex !
gift :) (CF)
Happy Times :) (CF)
Have Fun :) (C)
Here is what u wanted (C)
Heyyyy (F)
hey Check this out ;) (f)
heyyyI can't be online tonight :(anyway , i sent u something u r
gonna love ;)cya tomorrow (F)
Heyi have just got it , plz tell me if u need more.bye (F)
HeyI thought you trusted me but ...i haven't ever thought i should
send u my briefcase to gain ur Trust .Have it all :) bye (F)
heyyyyi tried many times to send u this email but ur account was out
of storage as i thinkany way , make sure that i didn't and i won't
forget u :)Cya Forgotten :P (F)
Heyyyyyyyy Lola Wussaaap??I forgot to tell u , the other file is with
Sam:) bye (F)
Hey Wussap?Here is the Emmy ;) Dont tell Sam abt itCya (F)
Hey wussap?i lost Sara's Email plzz send this file to her :)and tell
her i can't be online tonightBye (F)
hey wuts up?i found this amazing file in my Recycled , i know u love
this kind of things ;)cyaaa (F)
Hii just wanted to say sorry for last nightand .. i wish u accept
this as an apologybye dear (F)
Hii'm fine , thanx for asking :)and thanx for the nice
attachements.but unfortunately, i don't remember youi will be waiting
for u emaill to remind me of your self.Hummm , i hope u accept this
show as an apology.bye (F)
Hiiiiiiii've got this surprise from a friend :)it really deserves a
few minutes of your time.Bye (F)
I lost the other email , anyway i sent u all u needCya (F)
i thing the subject is enough to describe the attached file !check it
out and replay your opinionCya (F)
I've got your email , but you forgot to upload the attachments.Don't
be selfish , i sent you all the files i have, send me anything :(bye
(F)
looool (C)
Never mind ! (CF)
Re: (C)
save it for hard times (CF)
See the attatched file (CF)
Surprise! (CF)
Take a look (C)
This is all i can send (C)
Try it (C)
Useful (CF)
Very funny (CF)
Wait for more :) (C)
YO DUMP , IM SICK OF UR EMAILS , IF U LOSE IT AGAIN I WONT GIVE IT TO
U, SAVE ITBYEEE (F)
You gonna love it (C)
you have to see this! (CF)
you seem to be mad @ me coz i didn't send u anything for along time,i
didn't forget u , but i was kinda busy , i've got all of ur
emailsthanx :) and i hope u accept this one as an apology. (F)

Message:

Note: forwarded message attached.  (It's disguised to look as if it
was forwarded from aYahoo account).  Then it says:HiiIs it really
illegal in da USA?who knows :Pif u have a weak heart i warn uDON'T see
dis Clip.Emagine two young children havincrazy sex fo da first time
togetha !loooool i'm still wonderin where thierparents were?Good ?uck
, oh sorry:">i mean Good Luck :)Bye

Attachment:

iLLeGal.exe

Comments: A mass-mailing worm that uses its own SMTP engine or Microsoft Outlook to send itselfto all addresses that it finds in files on the infected computer. Multiple copies of theworm can be attached to the outgoing email message. After sleeping about 15 minutes, it mayoverwrite all files in all folders on all writeable drives with 215 bytes of text. Itdeletes all files on drives D, E, F, and G.Variant C sends itself to the email addresses it finds in the files that have the .htm,.html, .eml, and .txt file extensions. Also attempts to spread itself through theKaZaA file-sharing network.

Symptoms:


 Displays a message entitled Sorry that says: Looooooooool , thanx fo
da time u spent thinking ov me 
 Then displays another message that says: it was a lil Joke don't be
mad :) 
 After overwriting all drives, it displays one more message titled
ZaCker that says: No Peace Without war,i hate war but im forced to
love it,Hidden Power's gonna b there wherever u r

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Update the virus definitions.
Restart the computer in Safe mode.
Run a full system scan, and delete all files that are detected as W32.Galil@mm. Manually delete SMTP.ocx and Mmails.dll.
Delete the value iLLeGaL.exe C:\%System%\mplayer.exe from the registry keys.