high
Summary
Summary
Action- More Information
| Included in our products from | April 2004 (3.80) |
|---|---|
| Protection available since | 10 February 2004 09:47:34 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
RavTimeXP= <WINDOWS>\MSTRAY.EXE
and delete it if it exists.
Close the registry editor.
More Information
W32/Wukill-B is an internet worm which can email itself to contacts found in the Microsoft Outlook address book.
The worm copies itself to the Windows folder as MSTRAY.EXE and creates the following registry entry so that MSTRAY.EXE is run automatically each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
RavTimeXP= <WINDOWS>\MSTRAY.EXE
The worm may copy itself to the A: floppy drive as Winkill.exe and may also copy itself to the following folders using random filenames consisting of 1-5 characters B-Z with an extension of EXE:
<WINDOWS>\System
<WINDOWS>\Web
<WINDOWS>\Fonts
<WINDOWS>\Temp
<WINDOWS>\Help
W32/Wukill-B may also drop a harmless data file called <WINDOWS>\Winfile.ini and COMMENT.HTT and DESKTOP.INI as hidden, system files in the root folder.
This worm may display the message "Warning. This File Has Been Damage!" upon execution:
W32/Wukill-B may open the File Manager application when executed on the 28th of the month.
|
