WWW.WOZER.COM
(THIS DOMAIN NAME IS FOR SALE)
click here for pricelist page

THIS WEBSITE WAS PUT TOGETHER TO HELP FOLKS WITH THE WOZER VIRUS.  THERE'S BEEN QUITE A FEW VARIANCES OF THIS NASTY WORM OUT THERE & IT SEEMS TO BE CONTINUING TO SPREAD.

The best sites that I have found is the SYMANTEC (NORTON ANTI-VIRUS) website located at: http://securityresponse.symantec.com/avcenter/venc/data/w32.wozer.worm.html

&

http://de.mcafee.com/virusInfo/default.asp?id=description&virus_k=100824

(I HAVE NO CONNECTIONS WITH SYMANTEC OR MACFEE - I JUST TRUST THEIR PRODUCTS)

The link also carries information on all the other versions of the Wozer virus along with various pages for removal instructions. 

After execution, the worm copies itself to %sysdir% as Explore.exe and eCard.zip. The following registry key is changed to run the virus at startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "Explorer.exe Explore.exe"

Network spreading:
This worm browses network connections to spread to other machines that allow write access to the C drive using the credentials of the infected user. It copies itself as WINUPDATE.EXE. and adds a call to that file in the AUTOEXEC.BAT.

Email spreading:
The worm harvests email addresses from files on the local system with the following file-extensions :

*.HTM
*.WAB
*.EML
*.ODS
*.MMF
*.NCH
*.MBX
*.TBB
*.CPP
*.DPR
*.FRM
*.BAS
*.DOC
*.RTF
*.VBS
*.TXT
*.HTML
*.ASP

It uses its own SMTP engine to send emails directly to the MTA of the destination domain.
The From address is always 'Superzone eCard' 'ecard@superzone.com'
Subject: 'Superzone eCard from Secret Admirer'
An attachment named eCard.zip contains the worm.

Another good source for virus detection is www.trendmicro.com .  They offer a free online virus scan which has proven to be quite accurate.  I would also recommend their site for scanning & repairing your pc regarding computer viruses and worms.