Security

Ask something
Discussion Locked

mysterious email worm

0 helpful
3 replies

by sab_arturo 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
last night i was using outlook express (not even sending an email) when norton anti-virus 2003 popped up saying it had detected a suspiscious email worm.
I quarantined it, but now no executables seem to run, i just get a message saying that the exe can't be found. When i try to get the command prompt, it says "ijwp.exe" cannot be found.

I have just uninstalled norton (as it could not clean or submit the worm). and programs seem to run correctly now....

I will update later if i have any news,any comments or help is appreciated.

Thanks,
Martin

3 replies

by joseph moore

The worm probably modified the HKEY_CLASSES_ROOT\exefile\shell\open\command portion of the registry. A virus can append itself to the Default value for this Registry key, so that every time ANY .EXE file is opened, the virus is ALSO opened.
This way, the virus does NOT append itself to the EXE files, but is still opened when any EXE is opened. It is a nasty trick that can be tough to fix.

Here is a link to another virus that did the same thing:
http://securityresponse.symantec.com/avcenter/venc/data/vbs.vmort.html
This is probably NOT the virus you have, but it did the same Registry hook that you are experiencing.
It tells you how to manually fix the Registry. Try that.

hope this helps

by sab_arturo

Thanks, but i managed to clean it with Ad-Aware and a fix from Bullguard.

Thanks anyway,
Artur0

This discussion is closed to new replies.