[diabolator]

this was running when i opened the close program screen.... A
i did a search for a.exe and this is what i got
C:\WINDOWS\SYSTEM\A.EXE
i deleted it and got the run on startup command out of my registry. anyone know what it could be?

[Advertisements]

Welcome diabolator

It's probably this worm:
W32.Galil.C@mm: http://[email protected]

Installation
A.exe is the worm's installer component. When it runs, it does the following:

  1. Copies itself to %System%\folder as these files:
          * a.bat
          * a.com
          * a.exe
          * a.pif
          * a.scr
          * a.sys

  2. Copies Explore.exe and SMTP.ocx to the %System%folder.

  3. Adds the value:

      "Explore"="%System%\explore.exe"

      to the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the worm's component runs when you restart Windows.

[admin]

Welcome diabolator

It's probably this worm:
W32.Galil.C@mm: http://[email protected]

Installation
A.exe is the worm's installer component. When it runs, it does the following:

  1. Copies itself to %System%\folder as these files:
          * a.bat
          * a.com
          * a.exe
          * a.pif
          * a.scr
          * a.sys

  2. Copies Explore.exe and SMTP.ocx to the %System%folder.

  3. Adds the value:

      "Explore"="%System%\explore.exe"

      to the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the worm's component runs when you restart Windows.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.