Win32.Evaman.A@mm Removal Tool 1.0
Symptoms:
Presence of registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.
|
0.00 
Freeware
0K
Windows Vista 
Symptoms:
Presence of registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.exe and the value
%SYSTEM%/wintasks.exe.
Presence of the wintasks.exe file in the %SYSTEM% directory.
Presence of a named mutex "MyNameIsEva".
Technical description: The worm comes by mail, with the following characteristics:
The message subject is one of:
returned mail
failure delivery
failed transaction
server error
mail failure
Delivery Status (Failure)
Once executed, the worm copies itself to Windows System directory as wintasks.exe, and it then opens notepad.
The worm creates the following registry key so as to run each time Window starts: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.exe with the value the path in the
Windows System directory where it has just copied itself.
tags
the worm wintasks exe hkey local mail failure failure delivery windows system system directory the following with the exe and the value registry key local machinesoftwaremicrosoftwindowscurrentversionrunwintasks
Download Win32.Evaman.A@mm Removal Tool 1.0
Download Win32.Evaman.A@mm Removal Tool 1.0
Similar software
Win32.Evaman.A@mm Removal Tool 1.0
BitDefender
Symptoms:
Presence of registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.
Win32.Bagle.AL@mm free removal tool 1.0
Bitdefender
Symptoms:
- Presence of file %SYSTEM%WINdirect.
Win32.MyDoom.M@mm Free Removal tool 1.0
SOFTWIN
Symptoms:
- Presence of the following registry key:
- HKLMSoftwareMicrosoftWindowsCurrentVersionRunJavaVM
with the following value:
- %WINDIR%java.
Win32.MyDoom.S@mm Free Removal tool 1.0
Bitdefender
Symptoms:
Presence of "winpsd.
Win32.Mabutu.A@mm Free Removal Tool 1.0
SOFTWIN
Symptoms:
Presence of files *twain.
Win32.Mydoom.V@mm Free Removal tool 1.0
Softwin
Symptoms: Presence of files Documents and SettingsAdministratorStart MenuProgramsStartuprx32hh00.
Win32.Bagle.AJ@mm Free Removal tool 1.0
Bitdefender
Free removal tool for Win32.
MiMail worm free removal tool
SoftWin
A NEW variant of the MiMail worm family, version C, is proliferating across the world, according to security firm iDefense.
Cadoa Arts/Science Presence 1.0
Cadoa Arts/Science
PRESENCE is a useful mypace manager that makes promotion fast and easy.
My Peak Flow 2.1
My-Peak-Flow.com
My Peak Flow tracks and charts readings from peak flow meters and asthma symptoms.
RSS