WWW.WOZER.COM THIS WEBSITE WAS PUT TOGETHER TO HELP FOLKS WITH THE WOZER VIRUS. THERE'S BEEN QUITE A FEW VARIANCES OF THIS NASTY WORM OUT THERE & IT SEEMS TO BE CONTINUING TO SPREAD. The best sites that I have found is the SYMANTEC (NORTON ANTI-VIRUS) website located at: http://securityresponse.symantec.com/avcenter/venc/data/w32.wozer.worm.html & http://de.mcafee.com/virusInfo/default.asp?id=description&virus_k=100824
The link also carries information
on all the other versions of the Wozer virus along with various pages for
removal instructions. After execution, the worm copies itself to %sysdir% as Explore.exe and eCard.zip. The following registry key is changed to run the virus at startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "Explorer.exe Explore.exe" Network
spreading: Email spreading: *.HTM It uses its own
SMTP engine to send emails directly to the MTA of the destination domain. Another good source for virus detection is www.trendmicro.com . They offer a free online virus scan which has proven to be quite accurate. I would also recommend their site for scanning & repairing your pc regarding computer viruses and worms. please visit the sponsors of
this page: |
|
|