W32.HLLW.Nettrash - nice

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.HLLW.Nettrash

Sender:

Varies.

Subject:

angry at me??
Check this out!
Funny for you...
How are you??
Need help!
RE: Why you not replying??
We need to talk...!
What's happening???
What's the problem?
Why are you so
You need help?

Message:

I tried to reach you at MSN Messenger but you weren't online! I got
something important to tell you!
You said you needed help huh? Well attached file (You'll find what I
wanted to tell you there!) Ok. Reply as soon as possible!Bye!
Where have you been all the time??? I tried to call you but you
weren't home! Anyway, see the attached file! It's important! I got
the solution for your problem! Just open the attached file and see
what's in it ;)
I need your help! I'm in a very difficault position right now. I
can't decide how good the file is from rate 0 To 5! I need your
opinion on it, so check it out (It's attached to this message!) and
tell me what you think from rate 0 To 5!
Why are you so angry at me? What have I done to you?? I only want you
to check this file out; It describes my opinion about you. Please
check it, you won 't be dissapointed ;) Hope to hear from you soon :)

Attachment:

arabic sex.asp
arabic sex.com
arabic sex.doc
arabic sex.htm
arabic sex.jpg
arabic sex.mp3
arabic sex.mpg
arabic sex.php
arabic sex.txt
funny.asp
funny.com
funny.doc
funny.htm
funny.jpg
funny.mp3
funny.mpg
funny.php
funny.txt
information.asp
information.com
information.doc
information.htm
information.jpg
information.mp3
information.mpg
information.php
information.txt
interesting.asp
interesting.com
interesting.doc
interesting.htm
interesting.jpg
interesting.mp3
interesting.mpg
interesting.php
interesting.txt
nice_pic.asp
nice_pic.com
nice_pic.doc
nice_pic.htm
nice_pic.jpg
nice_pic.mp3
nice_pic.mpg
nice_pic.php
nice_pic.txt
nice song.asp
nice song.com
nice song.doc
nice song.htm
nice song.jpg
nice song.mp3
nice song.mpg
nice song.php
nice song.txt
ReadMe.asp
ReadMe.com
ReadMe.doc
ReadMe.htm
ReadMe.jpg
ReadMe.mp3
ReadMe.mpg
ReadMe.php
ReadMe.txt

Comments: A trojan horse that has components to spread using peer-to-peer file sharing,Microsoft Outlook, and IRC.

Symptoms:


 Copies itself to C:Windows, both as the original file name and a
hidden, read-only file named Login.scr 
 Adds the values: "User32" = (path to original filename) (original
file name) = (path to original filename) (For example, "NetTrash" =
"C:mydirnettrash.exe") to the registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun so that
the Trojan runs when you start Windows. 
 Adds the line: run=(original file name of Trojan) to the [windows]
section of the C:WindowsWin.ini file.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as W32.HLLW.Nettrash.
Delete the values that were added to the registry.
Edit the Win.ini file (Windows 95/98/Me).