W32/Wukill-B

Please follow the instructions for disinfecting PE executables.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
RavTimeXP= <WINDOWS>\MSTRAY.EXE

and delete it if it exists.

Close the registry editor.

W32/Wukill-B is an internet worm which can email itself to contacts found
in the Microsoft Outlook address book.

The worm copies itself to the Windows folder as MSTRAY.EXE and creates the
following registry entry so that MSTRAY.EXE is run automatically each time
Windows is started:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
RavTimeXP = %WINDOWS%\MSTRAY.EXE

The worm may copy itself to the A: floppy drive as Winkill.exe and may also
copy itself to the following folders using random filenames consisting of
1-5 characters B-Z with an extension of EXE:

%WINDOWS%\System
%WINDOWS%\Web
%WINDOWS%\Fonts
%WINDOWS%\Temp
%WINDOWS%\Help

W32/Wukill-B may also drop a harmless data file %WINDOWS%\Winfile.ini and the
following hidden, system files into the root folder:
COMMENT.HTT and DESKTOP.INI.

This worm may display a message box upon execution:
"Warning"
"This File Has Been Damage!".

W32/Wukill-B may open the File Manager application when executed on the 28th
of the month.