W32.Dumaru - myphoto.zip (YZ,AD)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Dumaru

Sender:

"Microsoft" (security@microsoft.com)
"Elene" (F**KENSUICIDE@HOTMAIL.COM) (censored) (YZ)
random characters@(a domain from an email addresses found on the
infected computer) (AH)

Subject:

Important information for you. Read it immediately ! (YZ)
Unknown (AH)
Use this patch immediately !

Message:

Dear friend , use this Internet Explorer patch now!
Hi ! Here is my photo, that you asked for yesterday. (YZ,AD)
There are dangerous virus in the Internet now!
More than 500.000 already infected!

Attachment:

document.zip (AH)
myphoto.zip (YZ,AD)
patch.exe

Comments: A mass-mailing worm that drops an IRC Trojan onto the infected machine. The worm gathersemail addresses from certain file types and uses its own SMTP engine to email itself.Steals email addresses from files with the extensions: .abd, .dbx, .htm, .html, .tbb and .wab (Y)

Symptoms:


 (95,98,ME) Modifies the windows section of win.ini so that it says: 
 [windows] 
 run=%Windir%dllreg.exe 
 Modifies the boot section of system.ini file (Windows 95/98/Me
only): 
 [boot] 
 shell=explorer.exe %System%vxdmgr32.exe 
 Copies itself as the following files: %System%L32x.exe.
%System%Vxd32v.exe, %Startup%Dllxw.exe and %Windir%TempZip.tmp (Z,AD) 
 Creates the file, %Windir%TEMPphoto.jpg, and launches explorer.exe
to load an image of a blonde model.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.Dumaru.M@mmorIRC Trojan. Restore all the .exe files in the root folder of all the drives C to Z.
Delete the value that was added to the registry.
Find and delete the files using the Windows Find or Search utility.
Remove the lines that the worm added to the Win.ini and System.ini files (Windows 95/98/Me).