W32.Gluber - news.pif (B)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Gluber

Sender:

Baath (baath@iraq.com)
BinLaden (osama@fbi.gov) (B)
BushScare (president@white.gov) (B)
careless (ch@care.net) (B)
condemn (fool@first.gov) (B)
Maybank (security@maybank2u.com) (B)
media (washtimes.com) (B)
Microsoft (support@microsoft.com) (B)
Rumsfeld (rumsfeld@pentagon.net) (B)
Terrorist Ariel Sharon (pm_eng@pmo.gov.il) (B)
Terrorist George W. Bush (president@whitehouse.gov) (B)

Subject:

Bad news! (B)
Bussiness (B)
Buy 1 Free 2 (B)
For World of Peace!
Free porn! (B)
great! (B)
Hack me! (B)
hello (B)
Hi! (B)
Need help! (B)
News! (B)
nice job! (B)
oh wow (B)
plz! (B)
Re: (B)
Report! (B)
Spend Money (B)
Too easy (B)
Update (B)
Warning! (B)
you are! (B)
Your resume (B)

Message:

A message you have received has been converte to an attachment. I
sorry cause that problem. (webmaster@winzip.com) (B)
For the truth of love! I have suprise to you! Please baby forgive me!
Ronn Elika (B)
Hello friend, I have a problem here. I have encrypt the file that
contain my message problem. The password is 'helpx'. Plz reply back!
(B)
Hey! It's that what you want! I hope so! Check the file first then
reply back if you have problem! By Alex Pravoks (B)
Oh my god! It's that you! Helo! Helo! So, this is gift for christmas
day! Orlian Jieg (B)
Saddam Hussien has been captured but Osama Bin Laden still have a
power and US willnever captured this person until somebody captured
Bush. God Bless You!!A.Q.T.E

Attachment:

bglr32.exe
brand.bat (B)
brand.com (B)
brand.exe (B)
brand.pif (B)
card.bat (B)
card.com (B)
card.exe (B)
card.pif (B)
collection.bat (B)
collection.com (B)
collection.exe (B)
collection.pif (B)
computers.bat (B)
computers.com (B)
computers.exe (B)
computers.pif (B)
credit.bat (B)
credit.com (B)
credit.exe (B)
credit.pif (B)
document.bat (B)
document.com (B)
document.exe (B)
document.pif (B)
fees.bat (B)
fees.com (B)
fees.exe (B)
fees.pif (B)
help.bat (B)
help.com (B)
help.exe (B)
help.pif (B)
image.bat (B)
image.com (B)
image.exe (B)
image.pif (B)
logfile.bat (B)
logfile.com (B)
logfile.exe (B)
logfile.pif (B)
magazine.bat (B)
magazine.com (B)
magazine.exe (B)
magazine.pif (B)
multi.bat (B)
multi.com (B)
multi.exe (B)
multi.pif (B)
music.bat (B)
music.com (B)
music.exe (B)
music.pif (B)
news.bat (B)
news.com (B)
news.exe (B)
news.pif (B)
pictures.bat (B)
pictures.com (B)
pictures.exe (B)
pictures.pif (B)
problem.bat (B)
problem.com (B)
problem.exe (B)
problem.pif (B)
quiz.bat (B)
quiz.com (B)
quiz.exe (B)
quiz.pif (B)
readme.bat (B)
readme.com (B)
readme.exe (B)
readme.pif (B)
request.bat (B)
request.com (B)
request.exe (B)
request.pif (B)
setup.bat (B)
setup.com (B)
setup.exe (B)
setup.pif (B)
text.bat (B)
text.com (B)
text.exe (B)
text.pif (B)
video.bat (B)
video.com (B)
video.exe (B)
video.pif (B)

Comments: A mass-mailing worm that uses its own SMTP engine to spread to email addresses it finds inthe files on your computer.(B) Can spread by email and network shares. Gives attacker complete access to your computer.

Symptoms:


 Copies itself as %System%Bglr32.exe. 
 Adds a line: shell=Explorer.exe bglr32.exe to the [boot] section of
the system.ini file, so that the worm runs when you start Windows
95/98/Me 
 Copies itself as %System%Djfgucxr.exe (B) 
 Modifies the %Windir%System.ini file. The worm adds the line:
shell=Explorer.exe Djfgucxr.exe to the [boot] section of the file

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: End the malicious process.
Run a full system scan and delete all the files detected as W32.Gluber@mm.
Edit the system.ini file.