W32.Erkez - link.flashcard.de.viewcard34.php.2672aB.pif

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Erkez

Sender:

Spoofed.

TO:
Anita
Anna
Beate
Claudia
Claudine
David
Erica
Eva
Francesca
Hanka
Jennifer
Katarina
Katya
Magdolina
Marica

Subject:

(Blank)
Atviruka!
Cartoe Virtuais!
Check this out kid!!!
Don`t worry, be happy!
Ecard!
E-carte!
E-Kartki!
E-Kort!
Elektronicka pohlednice!
E-postikorti!
E-Postkort!
Er staat een eCard voor u klaar!
E-vykort!
Flashcard fuer Dich!
Importante!
Ingyen SMS!
oKatya
Soxor Csok!
Ti e stata inviata una Cartolina Virtuale!
You`ve got 1 VoiceMessage!

Message:

Ahoj!Elektronick pohlednice ze serveru http://www.seznam.cz -
Ciao!ha visitato il nostro sito, cartolina.it e ha creato
unacartolina virtuale per te! Per vederla devi fare clicksul link
sottostante: http://cartolina.it/asp.viewcard=index4g345aAttenzione,
la cartolina sara visibile sui nostri server per2 giorni e poi verra
rimossa automaticamente.
Content: Te amo... ,
Dear Customer!You`ve got 1 VoiceMessage from voicemessage.com
website!Sender:You can listen your Virtual VoiceMessage at the
following link:http://virt.voicemessage.com/index.listen.php2=35affvor
by clicking the attached link.Send VoiceMessage! Try our new virtual
VoiceMessage Empire!Best regards: SNAF.Team (R).
De cand te-am cunoscut inima mea are un nou ritm!
Hallo!hat dir eine elektronische Flashcard geschickt.Um die Flashcard
ansehen zu koennen, benutze in deinem Browsereinfach den nun folgenden
link:http://flashcard.de/interaktiv/viewcards/view.php3?card=267BSwr34Viel
Spass beim Lesen wuenscht Ihnen ihr...
Hallo!heeft u een eCard gestuurd via de website nederlandsetaal in
het basisonderwijs...U kunt de kaart ophalen door de volgende url aan
te klikken of tekopiren in uw browser
link:http://postkaarten.nl/viewcard.show53.index=04abD1Met
vriendelijke groet,De redactie taalsite primair onderwijs...
Hi Honey!I`m in hurry, but i still love ya...(as you can see on the
picture)Bye - Bye:
------------------------ hirdet=E9s -----------------------------A
sikeres 777sms.hu =E9s az axelero.hu t=E1mogat=E1s=E1val =FAjraindul
az ingyenes sms k=FCld=F5 szolg=E1ltat=E1s! Jelenleg
ugyankorl=E1tozott sz=E1mban, napi 20 ingyen smst lehet
felhaszn=E1lni.K=FCldj te is SMST! Neh=E1ny kattint=E1s =E9s a
mell=E9kelt regisztr=E1ci=F3slap kit=F6lt=E9se ut=E1n azonnal
ig=E9nybevehet=F5! B=F5vebb inform=E1ci=F3ta www.777sms.hu oldalon
tal=E1lsz, de siess, mert az els=F5 ezerfelhaszn=E1l=F3 k=F6z=F6tt
=E9rt=E9kes nyerem=E9nyeket sorsolunk ki!------------------------
axelero.hu ---------------------------
Informacion importante que debes conocer, -
Iloista kesaa!
Linksmo gimtadieno! ha
Mit hjerte banker for dig!
Send me back bro, when you`ll be done...(if you know what i
mean...)See ya,
Szia!Aranyos vagy, j=F3 volt dumcsizni veled a neten!Rem=E9lem
tetszem, =E9s szeretn=E9m ha te is k=FClden=E9l k=E9petmagadr=F3l,
addig is cs=F3k:
Till min Alskade...
Vakre roser jeg sammenligner med deg...
vous a envoye une E-carte partir du site zdnet.frVous la trouverez,
l'adresse suivante
link:http://zdnet.fr/showcard.index.php34bs42www.zdnet.fr, plus de
3500 cartes virtuelles, vos pages weben 5 minutes, du dialogue en
direct...
W Dniu imienin...

Attachment:

anita.image043.jpg.pif
jennifer the wild girl xxx07.jpg.pif
link.atviruka.showcard.index.phpGz42.pif
link.cartoe.viewcard.index.phpYj39.pif
link.cartoline.it.viewcard.index.4g345a.pif
link.flashcard.de.viewcard34.php.2672aB.pif
link.informacion.phpV23.text.message.pif
link.kartki.showcard.index.phpVg42.pif
link.postikorti.showcard.index.phpGz42.pif
link.voicemessage.com.listen.index.php1Ab2c.pif
link.vykort.showcard.index.phpBn23.pif
link.zdnet.fr.ecarte.index.php34b31.pif
postkaarten.nl.link.viewcard.index.phpG4a62.pif
regiszt.php?3124freesms.index777.pif
view.link.index.image.phpV23.sexHdg21.pif
www.ecard.com.funny.picture.index.nude.php356.pif

Comments: A mass-mailing worm that sends itself to the email addresses found on an infected computer.

Symptoms:


 Creates the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoft_Hazafibb 
 Adds the value: "_Hazafibb"="%system%.exe" to the registry key:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: End the malicious process.
Run a full system scan and delete all the files detected as W32.Erkez.B@mm.
Reverse the changes made to the registry.