W32.Yaha - love.txt.pif (CEF)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Yaha

Sender:

A randomly-selected email address and may not be the legitimate
sender.
or
Is constructed by combining an item from this list: (KMPST)
admin@hackers.com
admin@hackersclub.com
admin@viruswriters.com
American Beauty
Benting
britneyspears.org
Cathy Kindergarten
Clark Steel
Club Jenna
Codeproject
Cupid
Hardcore Screensavers
Iori Yagami
Jasmine Stevens
Jaucques Antonio Barkinstein
Jenna Jameson
Jericho
John Vandervochich
Jonathan
Keanu Stevenson
Klein Anderson
KOF Online
Kyo Kusanagi
Love Inc.
Lovers Screensavers
McAfee Inc.
me2K
Nicolas Schwarzeneggar
Nomadic Screensavers
Noopman
Norton Antivirus
Omega Rugal
Paul Owen
Playboy Inc.
Plus 2
Plus 6
Ralph Jones
Raveena Pusanova
Real Inc.
Rocking Stone
Romantic Screensavers
Romeo & Juliet
Ross Anderson
Screensavers of Love
Sexy Screensavers
SQL Library
Super Soccer
Susan
Terry Bogard
The Rock
Trend Micro
Valentine Screensavers
Veronica Anderson
XXX Screensavers
Zdenka Podkapova
zporNstarS
and an item from this list:
admin@clubjenna.com ( AB)
admin@codeproject.com ( AB)
admin@hackers.com ( AB)
admin@hackersclub.com ( AB)
admin@kofonline.com ( AB)
admin@viruswriters.com ( AB)
admin@zpornstars.com ( AB)
American Beauty (AB)
av_patch@mcafee.com ( AB)
av_patch@norton.com ( AB)
av_patch@trendmicro.com ( AB)
Benting (AB)
britneyspears.org (AB)
btq@263.com ( AB)
caijob@online.sh.cn ( AB)
Call Girls (AB)
Cathy Kindergarten (AB)
cathy@21cn.com ( AB)
Cindy (AB)
cindy@salmaescorts.com (AB)
Clark Steel (AB)
Club Jenna (AB)
Codeproject (AB)
Cupid (AB)
cupid@freescreensavers.com ( AB)
Disney Int. (AB)
DNA_seraph@163.com ( AB)
ericpan@online.com.pk ( AB)
Escort services/ Call Girls (AB)
free@hardcorescreensavers.com ( AB)
free@sexyscreensavers.com ( AB)
free@sql.library.com ( AB)
free@xxxscreensavers.com ( AB)
GC Softwares Ltd. (AB)
HACKTEQ.NET (AB)
hamada@seikosangyo.com  ( AB)
Hardcore Screensavers (AB)
info@infotech.com (AB)
Infocom Technologies (AB)
Iori Yagami (AB)
Jaucques Antonio Barkinstein (AB)
Jasmine Stevens (AB)
jenna@jennajameson.com ( AB)
Jenna Jameson (AB)
Jericho (AB)
John Vandervochich (AB)
Jonathan (AB)
Keanu Stevenson (AB)
kkn@k2k.comscreensavers@nomadic.com ( AB)
kl@aminoprojects.com ( AB)
Klein Anderson (AB)
KOF Online (AB)
Kyo Kusanagi (AB)
Linda (AB)
linda@salmaescorts.com (AB)
Love Inc. (AB)
love@lovescreensavers.com ( AB)
Lovers Inc (AB)
loverscr@lovers.com (AB)
loverscreensavers@love.com (ABKMPST)
Lovers Screensavers (AB)
lubing@7135.com ( AB)
luoairong@21cn.com ( AB)
marketing@sega.com (AB)
marketing@playstation.com (AB)
marketing@suppersoccer.com ( AB)
marketing44@disney.biz (AB)
me@me2K.com (AB)
McAfee Inc. (AB)
me@me2K.com
me2K (AB)
newsletters@britneyspears.org ( AB)
Nicolas Schwarzeneggar (AB)
nics@noma.com (AB)
nics@nomadic.com
Nomadic Screensavers (AB)
Noopman (AB)
Norton Antivirus (AB)
Omega Rugal (AB)
paul@kqscore.com
Paul Owen (AB)
paul@kqscore2.com (AB)
Playboy Inc. (AB)
Playstation (AB)
Plus 2 (AB)
Plus 6 (AB)
plus@real.com ( AB)
Ralph Jones (AB)
Raveena Pusanova (AB)
ravs@go2pussy.com ( AB)
Real Inc. (AB)
Rocking Stone (AB)
Romantic Screensavers (AB)
romanticscreensavers@love.com ( AB)
Romeo & Juliet (AB)
Ross Anderson (AB)
sales@gcnetwork.com (AB)
sales@playboy.com ( AB)
sales@real.com ( AB)
sales@susoft.net (AB)
Salma (AB)
salma@salmaescorts.com (AB)
samsun@online.sh.cn ( AB)
screensavers@lovers.com ( AB)
Screensavers of Love (AB)
SEGA Corp. (AB)
sells@haqteq.net (AB)
services@tcsonline2.com ( AB)
Sexy Screensavers (AB)
SQL Library (AB)
St. Valentine (AB)
stone@esterplaza.com ( AB)
Super Soccer (AB)
super@21cn.com ( AB)
Susan (AB)
SuSoft Technologies Pvt. Ltd. (AB)
Terry Bogard (AB)
The Rock (AB)
therock@wwe.com ( AB)
t sales (AB)
Trend Micro (AB)
Valentine Screensavers (AB)
valentinescreensavers@t2k.com ( AB)
valscr@freescreensavers.com (AB)
Veronica Anderson (AB)
XXX Screensavers (AB)
yjworks@online.sh.cn ( AB)
Zdenka Podkapova (AB)
zdenka@zpornstars.com ( AB)
zhouyuye@citiz.net ( AB)
zporNstarS (AB)

Subject:

(blank) (CEF)
:-) (CEF)
! (CEF)
!! (CEF)
¯ (CEF)
4 U only.. (AB)
Alert (AB)
Are you a Soccer Fan ?  (ABKMPST)
Are you beautiful (ABKMPST)
Are you in Love (ABHKMPST)
Are you looking for Love (ABCEFKMPST)
Are you the BEST (ABKMPST)
Best Friends (CEF)
Bullsh*t (CEF)
charming (CEF)
Check it out  (ABKMPST)
Check this (H)
check this.. (AB)
Check this shit (ABKMPST)
Check ur friends Circle (ABCEFKMPST)
Cool (CEF)
Critical Updates (af)
Details. (af)
Demo KOF 2002 (ABKMPST)
Dont wait for long time (CEF)
Easy Way to revel ur love (CEF)
Enjoy friendship (CEF)
Enjoy Romantic life (CEF)
Enjoy this friendship-joke Screen Saver!!!! (B)
excite (CEF)
Experience the smooooth music (H)
Feel the fragrance of Love (ABKMPST)
Find a good friend (ABCEFKMPST)
Fix for latest W32.Blaster.Zworm (af)
Fix for New Worm Threat (af)
Fix for recent viruses (af)
Fix for the latest W32/Blaster.Z (af)
Fix for W32.Blaster/Welcha (af)
for you (CEF)
Freak Out (ABKMPST)
Free Demo Game (ABKMPST)
Free Disney Screensavers (AB)
Free rAVs Screensavers (ABKMPST)
Free Screen saver (CEF)
Free Screensavers (ABABKMPST)
Free Screensavers 4 U (ABKMPST)
Free Screenavers of Love (ABKMPST)
Free Win32 API source  (ABKMPST)
Free XXX (ABKMPST)
Friendship (CEF)
Friendship Screen saver (CEFH)
Funny (CEF)
Fw: (CEF)
Fw: Critical Patches (af)
Fw: Enjoy this friendship-joke Screen Saver!!!!" or "Have a nice
day!!!! (B)
Fw: Melt the Heart of your Valentine with this beautiful Screen saver
GC Chat Networks 
Great (CEF)
Hardcore Screensavers 4 U  (ABKMPST)
Hello (ABKMPST)
Help someone.. (H)
hey check it yaar (ABKMPST)
Hi (ABCEFKMPST)
Hi.. (AB)
Hi check your computer with this!!! (af)
how are you (CEF)
How sweet this Screen saver (ABCEFKMPST)
humour (CEF)
I am For u (CEF)
I am in Love (ABKMPST)
Idiot (CEF)
I Love You (ABKMPST)
I Love You..  (ABKMPST)
Interesting (CEF)
Its me .. (AB)
Jenna 4 U (ABKMPST)
Joke (CEF)
KOF - The Game 
Learn How To Love (ABCEFKMPST)
Learn SQL 4 Free  (ABKMPST)
Let's Dance and forget pains (ABCEFKMPST)
Let's Laugh (CEF)
Life for enjoyment (CEF)
Looking for Friendship (CEFKMPST)
Love (CEF)
LoveGangs (CEF)
Lovers Corner (ABKMPST)
Lovers Screensaver (AB)
love speaks from the heart (ABCEFKMPST)
Looking for Friendship (AB)
make ur friend happy (ABCEFKMPST)
mAtRiX (H)
Matrix - The Game 
Melt the Heart of your Valentine with this beautiful Screen saver
Missing your best friend ? (H)
My favourite links ... 
My Feelings 4 U (AB)
Naughty Movie Clip (af)
Need a friend? (ABCEFKMPST)
Need money ?? (ABKMPST)
New (CEF)
Nice (CEF)
Nothink to worryy (CEF)
OE 6 Patch 
One (CEF)
One Hackers Love (ABCEFKMPST)
One Virus Writer's Story  (ABKMPST)
One Way to Love (CEF)
Origin of Friendship (CEF)
Pamela 4 U (H)
Patch for Elkern.gen (ABKMPST)
Patch for Klez.H (ABKMPST)
Play KOF 2002 4 Free (ABKMPST)
powful (CEF)
Private Documents.... 
Project (ABKMPST)
relations (CEF)
Romantic (CEF)
RPCDCOM.ZIP ( Which is a zip file that contains a copy of worm) (af)
Sample KOF 2002 (ABKMPST)
Sample Playboy  (ABKMPST)
Sample Screensavers (KMPST)
Say 'I Like You' To ur friend (ABCEFKMPST)
Screensaver (CEF)
Screensavers from Club Jenna (ABKMPST)
searching for true Love (CEF)
Send This to everybody u like (CEF)
sexy call girls (AB)
Sexy Screensavers 4 U (ABKMPST)
Shaking (CEF)
Shake it baby (ABCEFKMPST)
Shake ur friends (CEF)
Still Dreaming.. (H)
stuff (CEF)
SuSoft SCR Maker (AB)
The Hotmail Hack (ABKMPST)
The King of KOF (ABKMPST)
The world of lovers (CEF)
The world of Friendship (ABCEFKMPST)
Things to note (ABKMPST)
to check (CEF)
to enjoy (CEF)
to see (CEF)
to ur lovers (ABCEFKMPST)
to ur friends (ABCEFKMPST)
to watch (CEF)
to share (CEF)
True Love (ABCEFKMPST)
Ultimate Hackers tool unleashed.. 
U realy Want this (ABCEFKMPST)
U r the person? (CEF)
Ur My Best Friend (CEF)
Valentine Screensavers (AB)
Visit us (ABKMPST)
Wanna be a hacker ? (H)
Wanna be a HE-MAN (ABKMPST)
Wanna be friends ?? (ABKMPST)
Wanna be like a stone ? (ABKMPST)
Wanna be my sweetheart ?? (ABKMPST)
Wanna Brawl ?? (ABKMPST)
wanna exchange.. (AB)
Wanna Hack ?? (ABKMPST)
Wanna Rumble ?? (ABKMPST)
war Againest Loneliness (ABCEFKMPST)
We want peace (ABKMPST)
Whats up (ABKMPST)
Who is ur Best Friend (ABCEFKMPST)
Who is your Valentine (ABKMPST)
why u send me this... (AB)
Wicked Screen Saver (af)
Wonderfool (CEF)
World Tour (ABKMPST)
Wowwwwwwwwwww check it (ABCEFKMPST)
WWE Screensavers (ABKMPST)
XXX Screensavers (AB)
XXX Screensavers 4 U (ABKMPST)
Yahoo Matchmakers (AB)
You are so sweet (ABKMPST)
you care ur friend (CEF)
Your application (af)
Your details (af)
Your previous message is infected (af)

Message:

Check the Attachement ..
Dear Customer,Thanks for using Microsoft products. Recent viruses
have prompted micrsoft to issue patchesto all its customers
worldwide.We are including a comprehensive patch for all windows
platforms. This patch gives youcomprehensive protection against all
recent viruses.Yours sincerely,JimThompsonTeam SupportMicrosoft
Incperson who registerswith us through your account, we will pay you
$1.5.Once your account reachesthe limit of $50, your payment will be
send to your registration address bycheck or draft.Please note that
the registration process is completely free which meansby
participating in this program you will only gain without loosing
anything.Best Regards,Admin, (af)
Dear customer,We are enclosing Fix for both Welcha and Blaster worms
as per your request.Step by Step Instructions for Cleaning
W32.Blaster/W32.Welcha Worms:1. Save the file to a convenient
location, such as your downloads folder or the Windows Desktop(or
removable media that is known to be uninfected, if possible).2. To
check the authenticity of the digital signature, refer to the
section, "Digital signature."3. Close all the running programs before
running the tool.4. If you are running Windows XP, then disable System
Restore.Refer to the section, "System Restore option in Windows
Me/XP," for additional details.In case of any clarifications please
do not hesitate to contact us.Best Regards,Neil ThomasSymantec
Support (af)
Dear customer,We are enclosing Fix for W32.Blaster.Z as per your
request.Step by Step Instructions for Cleaning W32.Blaster.Z1. Save
the file to a convenient location, such as your downloads folder or
the Windows Desktop(or removable media that is known to be
uninfected, if possible).2. To check the authenticity of the digital
signature, refer to the section, "Digital signature."3. Close all the
running programs before running the tool.4. If you are running Windows
XP, then disable System Restore.Refer to the section, "System Restore
option in Windows Me/XP," for additional details.In case of any
clarifications please do not hesitate to contact us.Best
Regards,Jerry NelsonMcAfee Support (af)
Enjoy this friendship Screen Saver and Check ur friends circle... (H)
Hi All,I am sending these fixes to the recent viruses which have been
making rounds in the IT world.I request you to install the same in
your systems and pass it to others.Yours sincerely,JamesSystem
AdministratorKPMG (af)
hi, check the attached love screensaverand feel the fragrance of true
love.. (KMPST)
Hi,check the attached screensaver..its really wonderfool..i got it
from freescreensavers.com (KMPST)
Hi Dear
Hi,I am cutting and pasting the message i got from symantec
antivirusI think the last mail you sent me was infected with
W32.Blaster.RgdsDear customer,We are enclosing Fix for both Welcha
and Blaster worms as per your request.Step by Step Instructions for
Cleaning W32.Blaster/W32.Welcha Worms:1. Save the file to a
convenient location, such as your downloads folder or the Windows
Desktop2. To check the authenticity of the digital signature, refer
to the section, "Digital signature."3. Close all the running programs
before running the tool.4. If you are running Windows XP, then disable
System Restore.Refer to the section, "System Restore option in Windows
Me/XP," for additional details.In case of any clarifications please do
not hesitate to contact us.Best Regards,Neil ThomasSymantec Support
(af)
Hi,I got this mail from Mcafee Antivirus Support. There is a new
variant of W32.Blaster worm.I got a special fix today in the early
hours, please check your machine with the attached tool.I have also
cut and pasted the steps for cleaning.Rgds (af)
Hi,I got this mail from Mcafee Antivirus Support. There is a new
variant of W32.Blaster worm.I got a special fix today in the early
hours, please check your machine with the attached tool.I have also
cut and pasted the steps for cleaning.RgdsDear customer,We are
enclosing Fix for W32.Blaster.Z as per your request.Step by Step
Instructions for Cleaning W32.Blaster.Z1. Save the file to a
convenient location, such as your downloads folder or the Windows
Desktop2. To check the authenticity of the digital signature, refer
to the section, "Digital signature."3. Close all the running programs
before running the tool.4. If you are running Windows XP, then disable
System Restore.Refer to the section, "System Restore option in Windows
Me/XP," for additional details.In case of any clarifications please do
not hesitate to contact us.Best Regards,Jerry NelsonMcAfee Support
(af)
Hi,I got this mail from Microsot support. Atlast Microsoft has got a
comprehensive patchfor all the vulnerabilities. Once this patch is
applied, it takes care of all the recent virus problemsin Microsoft
products.Later....Microsoft support wrote:>Thanks for using Microsoft
products. Recent viruses have prompted micrsoft to issue patches>to
all its customers worldwide.>>We are including a comprehensive patch
for all windows platforms. This patch gives you>comprehensive
protection against all recent viruses.>>Yours sincerely,>Kelly>Team
Support>Microsoft Inc (af)
Hi,See the attached file for details.Rgds (af)
Hi,This is an interesting movie clip. You will enjoy it.Rgds (af)
Hi,This is the most wicked screen saver i have ever
seen.Enjoy!!!'Rgds (af)
Hi,We have your email id in our database. We have enclosed our
requirements.Expecting your reply at the earliest.Kind Rgds,James
Martin (af)
Hi,Your previous mail to me is infected with Blaster.I am attaching
the tool i got from symantec site please clean your machine with the
same.Best Rgds, (af)
[Infected Username]
Klez.H is the most common world-wide spreading worm.It's very
dangerous bycorrupting your files. Because of its very smart stealth
and anti-anti-virustechnic,most common AV software can't detect or
clean it. We developed this freeimmunity tool to defeat the malicious
virus. You only need to run this tool once,andthen Klez will never
come into your PC (KMPST)
Microsoft RPC Heap Corruption Vulnerability - Part IISeverity:High
(Remote Code Execution).Description:eEye Digital Security has
discovered a critical remote vulnerability in the way
MicrosoftWindows handles certain RPC requests.The RPC (Remote
Procedure Call) protocol providesan inter-process communication
mechanism allowing a program running on one computer to execute code
on a remote system. 'The vulnerabilityexists within the DCOM
(Distributed Component Object Model) RPC interface. This interface
handlesDCOM object activation requests sent by client machines to the
server. By sending a malformedrequest packet it is possible to
overwrite various heap structures and allow the execution ofarbitrary
code.Please install the attached patch immediately. (af)
Please see the attached file for applicaion details.Rgds (af)
Please see the attached file for detailsRgds (af)
See the attached file for your documentsRgds (af)
See u
or
----- Original Message -----
From: "Friendship" (friendshipscr@[URL constructed above])
To: ([Infected User's e-mail Address])
Sent: Friday,  May 11, 2002 8:38 PM
Subject: [Subject constructed above]
This e-mail is never sent unsolicited. If you need to unsubscribe,
follow the instructions at the bottom of the message.
***********************************************************
Enjoy this friendship Screen Saver and Check ur friends circle...
Send this screensaver from www.[URL constructed above] to everyone
you
consider a FRIEND, even if it means sending it back to the person
who sent it to you. If it comes back to you, then you'll know you
have a circle of friends.
* To remove yourself from this mailing list, point your browser to:
http://[URL constructed above]/remove?freescreensaver
* Enter your email address ([infected user's e-mail address]) in the
field provided and click "Unsubscribe". (CEF)
This e-mail is never sent unsolicited. If you need to
unsubscribe,follow the instructions at the bottom of the
message.***********************************************************

Attachment:

Beautifull.scr (KMPST,AA)
Be_happy.scr (KMPST,AA)
Best_friend.scr (KMPST,AA)
Bestfriend.scr.doc.scr (H)
Bestfriend.scr.gif.scr (H)
Bestfriend.scr.jpg.scr (H)
Bestfriend.scr.pdf.scr (H)
Bestfriend.scr.ppt.scr (H)
biodata.bmp.bat (CEF)
biodata.bmp.pif (CEF)
biodata.bmp.scr (CEF)
biodata.dat.bat (CEF)
biodata.dat.pif (CEF)
biodata.dat.scr (CEF)
biodata.doc.bat (CEF)
biodata.doc.pif (CEF)
biodata.doc.scr (CEF)
biodata.gif.bat (CEF)
biodata.gif.pif (CEF)
biodata.gif.scr (CEF)
biodata.htm.bat (CEF)
biodata.htm.pif (CEF)
biodata.htm.scr (CEF)
biodata.jpg.bat (CEF)
biodata.jpg.pif (CEF)
biodata.jpg.scr (CEF)
biodata.mdb.bat (CEF)
biodata.mdb.pif (CEF)
biodata.mdb.scr (CEF)
biodata.mpg.bat (CEF)
biodata.mpg.pif (CEF)
biodata.mpg.scr (CEF)
biodata.mp3.bat (CEF)
biodata.mp3.pif (CEF)
biodata.mp3.scr (CEF)
biodata.txt.bat (CEF)
biodata.txt.pif (CEF)
biodata.txt.scr (CEF)
biodata.wav.bat (CEF)
biodata.wav.pif (CEF)
biodata.wav.scr (CEF)
biodata.xls.bat (CEF)
biodata.xls.pif (CEF)
biodata.xls.scr (CEF)
biodata.zip.bat (CEF)
biodata.zip.pif (CEF)
biodata.zip.scr (CEF)
Body_Building.scr (KMPST,AA)
Britney_Sample.scr (KMPST,AA)
Codeproject.scr (KMPST,AA)
Colour_of_life.scr (KMPST,AA)
Cupid.scr (KMPST,AA)
dailyreport.bmp.bat (CEF)
dailyreport.bmp.pif (CEF)
dailyreport.bmp.scr (CEF)
dailyreport.dat.bat (CEF)
dailyreport.dat.pif (CEF)
dailyreport.dat.scr (CEF)
dailyreport.doc.bat (CEF)
dailyreport.doc.pif (CEF)
dailyreport.doc.scr (CEF)
dailyreport.gif.bat (CEF)
dailyreport.gif.pif (CEF)
dailyreport.gif.scr (CEF)
dailyreport.htm.bat (CEF)
dailyreport.htm.pif (CEF)
dailyreport.htm.scr (CEF)
dailyreport.jpg.bat (CEF)
dailyreport.jpg.pif (CEF)
dailyreport.jpg.scr (CEF)
dailyreport.mdb.bat (CEF)
dailyreport.mdb.pif (CEF)
dailyreport.mdb.scr (CEF)
dailyreport.mpg.bat (CEF)
dailyreport.mpg.pif (CEF)
dailyreport.mpg.scr (CEF)
dailyreport.mp3.bat (CEF)
dailyreport.mp3.pif (CEF)
dailyreport.mp3.scr (CEF)
dailyreport.txt.bat (CEF)
dailyreport.txt.pif (CEF)
dailyreport.txt.scr (CEF)
dailyreport.wav.bat (CEF)
dailyreport.wav.pif (CEF)
dailyreport.wav.scr (CEF)
dailyreport.xls.bat (CEF)
dailyreport.xls.pif (CEF)
dailyreport.xls.scr (CEF)
dailyreport.zip.bat (CEF)
dailyreport.zip.pif (CEF)
dailyreport.zip.scr (CEF)
Dance.scr (KMPST)
dance.scr (AA,AB)
Demo.exe (AA,AB)
Demo.zip (AA,AB)
details.pif ( Which is a zip file that contains a copy of worm) (af)
disney.zip (AA,AB)
Escort.scr.doc.scr (H)
Escort.scr.gif.scr (H)
Escort.scr.jpg.scr (H)
Escort.scr.pdf.scr (H)
Escort.scr.ppt.scr (H)
EvilDaemon.scr.doc.scr (H)
EvilDaemon.scr.gif.scr (H)
EvilDaemon.scr.jpg.scr (H)
EvilDaemon.scr.pdf.scr (H)
EvilDaemon.scr.ppt.scr (H)
FixBlast.com (af)
FixBlast.zip ( Which is a zip file that contains a copy of worm) (af)
FixBlastz.zip ( Which is a zip file that contains a copy of worm)
(af)
FixElkern.com (KMPST,AA)
FixKlez.com (KMPST,AA)
FreakOut.exe (KMPST,AA)
Free_Love_Screensavers.scr (KMPST,AA)
Friend_Finder.exe (KMPST,AA)
Friend_finder.exe (KMPST)
Friend_happy.scr (KMPST,AA)
friendship.scr (KMPST,AA)
friendship_funny.scr (KMPST,AA)
friends.scr (B)
Funny.scr (KMPST)
funny.scr (AA,AB)
Gc_messenger_exe (KMPST,AA)
GC_msgr.zip (AA,AB)
goldfish.bmp.bat (CEF)
goldfish.bmp.pif (CEF)
goldfish.bmp.scr (CEF)
goldfish.dat.bat (CEF)
goldfish.dat.pif (CEF)
goldfish.dat.scr (CEF)
goldfish.doc.bat (CEF)
goldfish.doc.pif (CEF)
goldfish.doc.scr (CEF)
goldfish.gif.bat (CEF)
goldfish.gif.pif (CEF)
goldfish.gif.scr (CEF)
goldfish.htm.bat (CEF)
goldfish.htm.pif (CEF)
goldfish.htm.scr (CEF)
goldfish.jpg.bat (CEF)
goldfish.jpg.pif (CEF)
goldfish.jpg.scr (CEF)
goldfish.mdb.bat (CEF)
goldfish.mdb.pif (CEF)
goldfish.mdb.scr (CEF)
goldfish.mpg.bat (CEF)
goldfish.mpg.pif (CEF)
goldfish.mpg.scr (CEF)
goldfish.mp3.bat (CEF)
goldfish.mp3.pif (CEF)
goldfish.mp3.scr (CEF)
goldfish.txt.bat (CEF)
goldfish.txt.pif (CEF)
goldfish.txt.scr (CEF)
goldfish.wav.bat (CEF)
goldfish.wav.pif (CEF)
goldfish.wav.scr (CEF)
goldfish.xls.bat (CEF)
goldfish.xls.pif (CEF)
goldfish.xls.scr (CEF)
goldfish.zip.bat (CEF)
goldfish.zip.pif (CEF)
goldfish.zip.scr (CEF)
Hacker.scr (KMPST,AA)
HackerTool.zip (AA,AB)
Hacker_The_LoveStory.scr (KMPST,AA)
Hardcore4Free.scr (KMPST,AA)
Honey.scr.doc.scr (H)
Honey.scr.gif.scr (H)
Honey.scr.jpg.scr (H)
Honey.scr.pdf.scr (H)
Honey.scr.ppt.scr (H)
Hotmail_hack.exe (AA)
Hotmail_hack_exe.scr (KMPST)
HotShot.scr.doc.scr (H)
HotShot.scr.gif.scr (H)
HotShot.scr.jpg.scr (H)
HotShot.scr.pdf.scr (H)
HotShot.scr.ppt.scr (H)
I_like_you.scr (KMPST,AA)
I_Love_You.scr (KMPST,AA)
Jenna_Jemson.scr (KMPST,AA)
King_of_Figthers.exe (KMPST)
KOF.exe (KMPST,AA)
KOF_Demo.exe (KMPST,AA)
KOF_Fighting.exe (KMPST,AA)
KOF_Sample.exe (KMPST,AA)
KOF_The_Game.exe (KMPST,AA)
KOF2002.exe (KMPST,AA)
Life.scr (KMPST)
life.scr (AA,AB)
love.bmp.bat (CEF)
love.bmp.pif (CEF)
love.bmp.scr (CEF)
love.dat.bat (CEF)
love.dat.pif (CEF)
love.dat.scr (CEF)
love.doc.bat (CEF)
love.doc.pif (CEF)
love.doc.scr (CEF)
love.gif.bat (CEF)
love.gif.pif (CEF)
love.gif.scr (CEF)
love.htm.bat (CEF)
love.htm.pif (CEF)
love.htm.scr (CEF)
love.jpg.bat (CEF)
love.jpg.pif (CEF)
love.jpg.scr (CEF)
love.mdb.bat (CEF)
love.mdb.pif (CEF)
love.mdb.scr (CEF)
love.mpg.bat (CEF)
love.mpg.pif (CEF)
love.mpg.scr (CEF)
love.mp3.bat (CEF)
love.mp3.pif (CEF)
love.mp3.scr (CEF)
Love.scr (KMPST,AA)
Love.scr.doc.scr (H)
Love.scr.gif.scr (H)
Love.scr.jpg.scr (H)
Love.scr.pdf.scr (H)
Love.scr.ppt.scr (H)
love.txt.bat (CEF)
love.txt.pif (CEF)
love.txt.scr (CEF)
love.wav.bat (CEF)
love.wav.pif (CEF)
love.wav.scr (CEF)
love.xls.bat (CEF)
love.xls.pif (CEF)
love.xls.scr (CEF)
love.zip.bat (CEF)
love.zip.pif (CEF)
love.zip.scr (CEF)
loveletter.bmp.bat (CEF)
loveletter.bmp.pif (CEF)
loveletter.bmp.scr (CEF)
loveletter.dat.bat (CEF)
loveletter.dat.pif (CEF)
loveletter.dat.scr (CEF)
loveletter.doc.bat (CEF)
loveletter.doc.pif (CEF)
loveletter.doc.scr (CEF)
loveletter.gif.bat (CEF)
loveletter.gif.pif (CEF)
loveletter.gif.scr (CEF)
loveletter.htm.bat (CEF)
loveletter.htm.pif (CEF)
loveletter.htm.scr (CEF)
loveletter.jpg.bat (CEF)
loveletter.jpg.pif (CEF)
loveletter.jpg.scr (CEF)
loveletter.mdb.bat (CEF)
loveletter.mdb.pif (CEF)
loveletter.mdb.scr (CEF)
loveletter.mpg.bat (CEF)
loveletter.mpg.pif (CEF)
loveletter.mpg.scr (CEF)
loveletter.mp3.bat (CEF)
loveletter.mp3.pif (CEF)
loveletter.mp3.scr (CEF)
loveletter.txt.bat (CEF)
loveletter.txt.pif (CEF)
loveletter.txt.scr (CEF)
loveletter.wav.bat (CEF)
loveletter.wav.pif (CEF)
loveletter.wav.scr (CEF)
loveletter.xls.bat (CEF)
loveletter.xls.pif (CEF)
loveletter.xls.scr (CEF)
loveletter.zip.bat (CEF)
loveletter.zip.pif (CEF)
loveletter.zip.scr (CEF)
LoveScr.scr (AA,AB)
LoveScr.zip (AA)
LoverScreenSaver.scr.doc.scr (H)
LoverScreenSaver.scr.gif.scr (H)
LoverScreenSaver.scr.jpg.scr (H)
LoverScreenSaver.scr.pdf.scr (H)
LoverScreenSaver.scr.ppt.scr (H)
make_scr.zip (AA,AB)
mAtRiX.scr.doc.scr (H)
mAtRiX.scr.gif.scr (H)
mAtRiX.scr.jpg.scr (H)
mAtRiX.scr.pdf.scr (H)
mAtRiX.scr.ppt.scr (H)
mountain.bmp.bat (CEF)
mountain.bmp.pif (CEF)
mountain.bmp.scr (CEF)
mountain.dat.bat (CEF)
mountain.dat.pif (CEF)
mountain.dat.scr (CEF)
mountain.doc.bat (CEF)
mountain.doc.pif (CEF)
mountain.doc.scr (CEF)
mountain.gif.bat (CEF)
mountain.gif.pif (CEF)
mountain.gif.scr (CEF)
mountain.htm.bat (CEF)
mountain.htm.pif (CEF)
mountain.htm.scr (CEF)
mountain.jpg.bat (CEF)
mountain.jpg.pif (CEF)
mountain.jpg.scr (CEF)
mountain.mdb.bat (CEF)
mountain.mdb.pif (CEF)
mountain.mdb.scr (CEF)
mountain.mpg.bat (CEF)
mountain.mpg.pif (CEF)
mountain.mpg.scr (CEF)
mountain.mp3.bat (CEF)
mountain.mp3.pif (CEF)
mountain.mp3.scr (CEF)
mountain.txt.bat (CEF)
mountain.txt.pif (CEF)
mountain.txt.scr (CEF)
mountain.wav.bat (CEF)
mountain.wav.pif (CEF)
mountain.wav.scr (CEF)
mountain.xls.bat (CEF)
mountain.xls.pif (CEF)
mountain.xls.scr (CEF)
mountain.zip.bat (CEF)
mountain.zip.pif (CEF)
mountain.zip.scr (CEF)
movie3498.zip ( Which is a zip file that contains a copy of worm)
(af)
MS-Q31338.ZIP ( Which is a zip file that contains a copy of worm)
(af)
MS-Q3526.com (af)
MS-Q3946.EXE (af)
My_Sexy_Pic.scr (KMPST,AA)
MyPic.scr (AA)
MyProfile.scr (KMPST,AA)
NeverMind.scr.doc.scr (H)
NeverMind.scr.gif.scr (H)
NeverMind.scr.jpg.scr (H)
NeverMind.scr.pdf.scr (H)
NeverMind.scr.ppt.scr (H)
Notes.exe (KMPST,AA)
OE6.zip (AA,AB)
oe6patch.exe (AA,AB)
Peace.scr (KMPST,AA)
Playboy.scr (KMPST,AA)
Plus2.scr (KMPST,AA)
Plus6.scr (KMPST,AA)
Project.exe (KMPST,AA)
Ravs.scr (KMPST,AA)
Real.scr (AB,AA)
report.bmp.bat (CEF)
report.bmp.pif (CEF)
report.bmp.scr (CEF)
report.dat.bat (CEF)
report.dat.pif (CEF)
report.dat.scr (CEF)
report.doc.bat (CEF)
report.doc.pif (CEF)
report.doc.scr (CEF)
report.gif.bat (CEF)
report.gif.pif (CEF)
report.gif.scr (CEF)
report.htm.bat (CEF)
report.htm.pif (CEF)
report.htm.scr (CEF)
report.jpg.bat (CEF)
report.jpg.pif (CEF)
report.jpg.scr (CEF)
report.mdb.bat (CEF)
report.mdb.pif (CEF)
report.mdb.scr (CEF)
report.mpg.bat (CEF)
report.mpg.pif (CEF)
report.mpg.scr (CEF)
report.mp3.bat (CEF)
report.mp3.pif (CEF)
report.mp3.scr (CEF)
report.txt.bat (CEF)
report.txt.pif (CEF)
report.txt.scr (CEF)
report.wav.bat (CEF)
report.wav.pif (CEF)
report.wav.scr (CEF)
report.xls.bat (CEF)
report.xls.pif (CEF)
report.xls.scr (CEF)
report.zip.bat (CEF)
report.zip.pif (CEF)
report.zip.scr (CEF)
Requirement.zip ( Which is a zip file that contains a copy of worm)
(af)
resume.bmp.bat (CEF)
resume.bmp.pif (CEF)
resume.bmp.scr (CEF)
resume.dat.bat (CEF)
resume.dat.pif (CEF)
resume.dat.scr (CEF)
resume.doc.bat (CEF)
resume.doc.pif (CEF)
resume.doc.scr (CEF)
resume.gif.bat (CEF)
resume.gif.pif (CEF)
resume.gif.scr (CEF)
resume.htm.bat (CEF)
resume.htm.pif (CEF)
resume.htm.scr (CEF)
resume.jpg.bat (CEF)
resume.jpg.pif (CEF)
resume.jpg.scr (CEF)
resume.mdb.bat (CEF)
resume.mdb.pif (CEF)
resume.mdb.scr (CEF)
resume.mpg.bat (CEF)
resume.mpg.pif (CEF)
resume.mpg.scr (CEF)
resume.mp3.bat (CEF)
resume.mp3.pif (CEF)
resume.mp3.scr (CEF)
resume.txt.bat (CEF)
resume.txt.pif (CEF)
resume.txt.scr (CEF)
resume.wav.bat (CEF)
resume.wav.pif (CEF)
resume.wav.scr (CEF)
resume.xls.bat (CEF)
resume.xls.pif (CEF)
resume.xls.scr (CEF)
resume.zip.bat (CEF)
resume.zip.pif (CEF)
resume.zip.scr (CEF)
Romantic.exe (AA)
Romantic.scr (KMPST)
Romeo_Juliet.scr (KMPST,AA)
ScreenSaver.scr.doc.scr (H)
ScreenSaver.scr.gif.scr (H)
ScreenSaver.scr.jpg.scr (H)
ScreenSaver.scr.pdf.scr (H)
ScreenSaver.scr.ppt.scr (H)
Screensavers.scr (KMPST,AA)
Services.scr (KMPST,AA)
Setup.exe (AA)
Setup.zip (AA,AB)
Sex.scrSoccer.scr  (KMPST,AA)
Sexy_Jenna.scr (KMPST,AA)
Shake.scr (KMPST,AA)
Soccer.scr (T)
SQL_4_Free.scr (KMPST,AA)
Stone.scr (KMPST,AA)
Sweet.scr (KMPST,AA)
Sweetheart.scr (KMPST,AA)
thankyou.zip ( Which is a zip file that contains a copy of worm) (af)
The_Best.scr (KMPST,AA)
THEROCK.scr (KMPST,AA)
True_love.scr (KMPST,AA)
up_life.scr (KMPST,AA)
valentin.scr (A)
Valentine.scr (AA,AB)
Valentines_Day.scr (KMPST,AA)
VXer_The_LoveStory.scr (KMPST,AA)
Ways_To_Earn_Money.exe (KMPST,AA)
weeklyreport.bmp.bat (CEF)
weeklyreport.bmp.pif (CEF)
weeklyreport.bmp.scr (CEF)
weeklyreport.dat.bat (CEF)
weeklyreport.dat.pif (CEF)
weeklyreport.dat.scr (CEF)
weeklyreport.doc.bat (CEF)
weeklyreport.doc.pif (CEF)
weeklyreport.doc.scr (CEF)
weeklyreport.gif.bat (CEF)
weeklyreport.gif.pif (CEF)
weeklyreport.gif.scr (CEF)
weeklyreport.htm.bat (CEF)
weeklyreport.htm.pif (CEF)
weeklyreport.htm.scr (CEF)
weeklyreport.jpg.bat (CEF)
weeklyreport.jpg.pif (CEF)
weeklyreport.jpg.scr (CEF)
weeklyreport.mdb.bat (CEF)
weeklyreport.mdb.pif (CEF)
weeklyreport.mdb.scr (CEF)
weeklyreport.mpg.bat (CEF)
weeklyreport.mpg.pif (CEF)
weeklyreport.mpg.scr (CEF)
weeklyreport.mp3.bat (CEF)
weeklyreport.mp3.pif (CEF)
weeklyreport.mp3.scr (CEF)
weeklyreport.txt.bat (CEF)
weeklyreport.txt.pif (CEF)
weeklyreport.txt.scr (CEF)
weeklyreport.wav.bat (CEF)
weeklyreport.wav.pif (CEF)
weeklyreport.wav.scr (CEF)
weeklyreport.xls.bat (CEF)
weeklyreport.xls.pif (CEF)
weeklyreport.xls.scr (CEF)
weeklyreport.zip.bat (CEF)
weeklyreport.zip.pif (CEF)
weeklyreport.zip.scr (CEF)
World_of_friendship.scr (KMPST,AA)
World_Tour.scr (KMPST,AA)
xxx4Free.scr (KMPST,AA)
zDenka.scr (KMPST,AA)
zXXX_BROWSER.exe (KMPST,AA)

Comments: A mass-mailer that sends itself to all email addresses it finds in the Windows address bookand within files that have the extension of .ht*. It copies itself to the files,C:\Recycled\Msscra.exe and C:\Recycled\Msmdm.exe.

Symptoms:


 It sets itself to run whenever any other executable files are run by
modifying the (Default) value of the registry key: 
 HKEY_LOCAL_MACHINESoftwareClassesexefileshellopencommand 
 to read: c:recycledmsmdm" %1 %*" instead of " %1 %*". (ABCEF) 
 If the system date is March 25 or May 22, the worm switches the
functions of the left and right mouse buttons and displays a window
thats says: Happy Birthday Dear. (KMPST) 
 If the day of the week is Wednesday, the worm changes the Internet
Explorer home page to: http:/ /www.indiansnakes.cjb.net (S) 
 Copies itself to the WindowsSystem folder as one of the following
files: Hotmail_hack.exe, friendship.scr, world_of_friendship.scr,
shake.scr, Sweet.scr (U)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Configure Windows to show all files
Copy Regedit.exe to Regedit.com (in most cases)
Edit the registry and remove keys and changes that the worm made
Delete files that the worm placed on the computer
Run a full system scan