Тип вируса: Семейство почтовых червей массовой рассылки
Уязвимые ОС: Win95/98/Me/NT/2000/XP
Размер файла: 80 321 байт, 38 401 байт, 112 132 байта, 32 839 байт, 117 252 байта, 157 197 байт, 121 860 байт, 70 146 байт, 37 377 байт, 111 616 байт, 163 844 байта, 139 264 байта, 38 402 байта, 38 913 байт, 38 913 байт, 166 913 байт, 38 912 байт, 36 865 байт, 123 904 байта
Упакован: UPX
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
ad.fastclick.net
ads.fastclick.net
ar.atwola.com
atdmt.com
avp.ch
avp.com
avp.ru
awaps.net
banner.fastclick.net
banners.fastclick.net
ca.com
click.atdmt.com
clicks.atdmt.com
dispatch.mcafee.com
download.mcafee.com
download.microsoft.com
downloads.microsoft.com
engine.awaps.net
fastclick.net
f-secure.com
ftp.f-secure.com
ftp.sophos.com
go.microsoft.com
liveupdate.symantec.com
mast.mcafee.com
mcafee.com
media.fastclick.net
msdn.microsoft.com
my-etrust.com
nai.com
networkassociates.com
office.microsoft.com
phx.corporate-ir.net
secure.nai.com
securityresponse.symantec.com
service1.symantec.com
sophos.com
spd.atdmt.com
support.microsoft.com
symantec.com
update.symantec.com
updates.symantec.com
us.mcafee.com
vil.nai.com
viruslist.ru
windowsupdate.microsoft.com
www.avp.ch
www.avp.com
www.avp.ru
www.awaps.net
www.ca.com
www.fastclick.net
www.f-secure.com
www.kaspersky.ru
www.mcafee.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.sophos.com
www.symantec.com
www.trendmicro.com
www.viruslist.ru
www3.ca.com
localhost
.txt
.htm
.wab
.tbb
.dbx
Hi
Did you get the previous document I attached for you?
I resent it in this email just in case, because I
really need you to check it out asap.
Best Regards
Hi
I made a mistake and forgot to click attach
on the previous email I sent you. Please give me
your opinion on this opportunity when you get a chance.
Best Regards
Hi
Sorry, I forgot to send an important
document to you in that last email. I had an important phone call.
Please checkout attached doc file when you have a moment.
Best Regards
I was in a rush and I forgot to attach an important
document. Please see attached doc file.
Sorry to bother you, but I am having a problem receiving your emails.
I am responding to your last email in the attached file.
Please get back to me if there is any problem reading the attachment.
I am responding to your last email in the attached file.
I had a delivery problem with your inbox, so maybe you'll receive this now.
Can you please check out the email I have attached?
For some reason, I received only part of your last several emails.
I want to make sure that there are no problems with either of our accounts.
This email is being sent as attachment because
it was previously blocked by your email filters.
Please view the attachment and respond.
Thanks
I resent this email as attachment because
it was previously blocked by your email filters.
Please read the attachment and respond.
Thanks
I apologize, but I need you to verify
that I have the correct contact info for you.
My system crashed last weekend and
I lost most of my friends and work contacts.
Please check the attached (.pdf) and
please let me know if your info is current.
My last email to you was returned.
The reason is that I am not currently
added to your "allowed" contact list.
Please add my updated contact info
provided in the attached (.pdf) file
so I can send you emails in the future.
Sincerely
I have updated my email address
See the (.pdf) file attached and
please respond if you have any questions.
We have made recent updates to our database.
Please verify your mailing address on file is correct.
We have attached a (.pdf) sheet for you to use for your response.
Hello
Our contact information has changed.
See the attached (.pdf) sheet for details.
Sincerely,
***URGENT: SERVICE SHUTDOWN NOTICE***
Due to your failure to comply with our email
Rules and Regulations, your email account has been
temporarily suspended for 24 hours unless we are contacted regarding
this situation.
You must read the attached document for further
instructions. Failure to comply will result in termination of your account.
Regards, Net Operator
***URGENT: SERVICE SHUTDOWN NOTICE***
***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
You are currently unable to send emails.
This may be a billing issue.
Please call the billing center.
The # for the billing office is located in the attached
contact list for your convenience.
***ATTENTION: YOUR EMAIL IS NOT BEING DELIVERED!***
***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
Hello,
The previous email you sent has been recognized as spam.
This means your email was not delivered to your friend or client.
You must open the attached file to receive more information.
***YOUR MESSAGE HAS BEEN RECOGNIZED AS SPAM***
Hello,
What version of windows you are using?
This last document I received from you came out weird.
Please see the attached word file and resend the file to me.
Many thanks, User
Hello,
My PC crashed while I was sending that last email.
I have re-attached the document of yours that I discovered.
Please read attached document and respond ASAP.
Sincerely, User
Hello,
Your email was sent in an INVALID format.
To verify this email was sent from you,
simply open the attached email (.eml) file
and click yes in the sender options box.
Thank You, User
Hello,
Your email was received.
YOUR REPLY IS URGENT!
Please view the attached text file for instructions.
Regards, User
Hello,
I was in a hurry and I forgot to attach an important
document. Please see attached.
Regards, User
Hello,
I resent this email as attachment because
it was previously blocked by your email filters.
Please read the attachment and respond.
Thanks, User
Hello,
I resent this email as attachment because
it was previously blocked by your email filters.
Please read the attachment and respond.
Sincerely, User
ASAP
please responce
Read this
urgent
toxic
contract
Money
office
Have a nice day
Hello
Russian's
Amirecans
attachments
attach
waiting
best regards
Administrator
Warning
text
Vasia
re: Andrey
re: please
кe: order
Allert!
Att
Hi
\persfw.exe
\sched.exe
\aswupdsv.exe
\aswregsvr.exe
\aswboot.exe
\ashskpck.exe
\ashskpcc.exe
\ashsimpl.exe
\ashserv.exe
\ashquick.exe
\ashpopwz.exe
\ashmaisv.exe
\ashlogv.exe
\ashdisp.exe
\ashchest.exe
\ashbug.exe
\ashavast.exe
\symnavo.dll
\statushp.dll
\sdstp32i.dll
\sdsok32i.dll
\sdsnd32i.dll
\sdpck32i.dll
\scriptui.dll
\scanmgr.dll
\scandres.dll
\scandlvr.dll
\savscan.exe
\savrtpel.sys
\savrt32.dll
\savrt.sys
\s32navo.dll
\s32integ.dll
\quaropts.dat
\quarantine
\quar32.dll
\qspak32.dll
\qconsole.exe
\qconres.dll
\ptchinst.dll
\probegse.dll
\patch25d.dll
\opscan.exe
\officeav.dll
\oeheur.dll
\netbrext.dll
\navwnt.exe
\navw32.exe
\navuihtm.dll
\navui.nsi
\navui.dll
\navtskwz.dll
\navtasks.dll
\navstub.exe
\navstats.dll
\navshext.dll
\navprod.dll
\navopts.dll
\navoptrf.dll
\navntutl.dll
\navlucbk.dll
\navlogv.dll
\navlnch.dll
\navlcom.dll
\navevent.dll
\naverror.dll
\navcomui.dll
\navcfgwz.dll
\navapw32.exe
\navapw32.dll
\navapsvc.exe
\navapscr.dll
\navap32.dll
\n32exclu.dll
\n32call.dll
\ltchkres.dll
\djsalert.dll
\defalert.dll
\cfgwzres.dll
\cfgwiz.exe
\ccimscn.exe
\ccimscan.dll
\ccavmail.dll
\bootwarn.exe
\avres.dll
\avcompbr.dll
\apwutil.dll
\apwcmdnt.dll
\aboutplg.dll
\zlparser.dll
\vsvault.dll
\vsruledb.dll
\vsmon.exe
\vsdb.dll
\vsavpro.dll
\ssleay32.dll
\cerbprovider.pvx
\camupd.dll
\zonealarm.exe
\zl_priv.htm
\zlclient.exe
\zav.zap
\zauninst.exe
\zatutor.exe
\tutorwiz.dll
\security.zap
\programs.zap
\idlock.zap
\framewrk.dll
\firewall.zap
\filter.zap
\email.zap
\alert.zap
\wormres.dll
\vsowow.dll
\vsoupd.dll
\vsoui.dll
\mcshield.dll
\vsagntui.dll
\shlres.dll
\shextres.inf
\shextbin.inf
\scrstres.inf
\scrpsbin.inf
\scrpres.dll
\scanserv.dll
\scan.dat
\patchw32.dll
\outscres.dll
\outscan.dll
\ntclient.dll
\naievent.dll
\naiann.dll
\mcvsworm.dll
\mcvsskt.dll
\mcvsshld.exe
\mcvsshl.dll
\mcvsscrp.dll
\mcvsrte.exe
\mcvsmap.exe
\mcvsftsn.exe
\mcvsescn.exe
\mcvsctl.dll
\mcurial.dll
\mcshield.exe
\mcscan32.dll
\mcmnhdlr.exe
\mcavtsub.dll
\imscnres.inf
\imscnbin.inf
\ftscnres.dll
\emscnres.dll
\edisk.dll
\ashldres.dll
\appinit.ini
\804mbd1.img
\804mbd1.chk
\mghtml.exe
\mcinfo.exe
\mcappins.exe
\dunzip32.dll
\mvtx.exe
\mpfwizard.exe
\mpfupdchk.dll
\mpfui.dll
\mpftray.exe
\mpfservice.exe
\mpfconsole.exe
\mpfagent.exe
webmaster@
update
unix
support@
support
spam
sopho
samples
root@
rating@
postmaster@
pgp
panda
ntivi
noreply
noone@
nobody@
news
netadmin@
local
listserv
linux
kasp
info@
icrosoft
hostmaster@
help@
google
gold-certs@
gold-
free-av
feste
f-secur
contract@
contact@
certs@
certific
cafee
bugs@
bsd
anyone@
all@
administrator@
admin
abuse
@microsoft
@messagelab
@iana
@foo
@avp
